Software · Cybersecurity
Vulnerability management
A single list of known weaknesses across your own systems, ranked by real risk and tracked until fixed.
Scanners produce thousands of findings, and most teams cannot tell which ten matter this week. We build vulnerability management software that pulls results from authorised scans of systems you own, matches them to assets and owners, and ranks them using CVSS, known exploitation and exposure. Each finding becomes a ticket with a deadline, and a rescan confirms the fix.
What we build
- An asset inventory built from cloud accounts, your CMDB, endpoint agents and network discovery
- Importers for authorised scan results from Greenbone OpenVAS, Trivy and Grype
- Risk scoring that combines CVSS, the CISA KEV catalogue, EPSS and internet exposure
- Automatic tickets in Jira or ServiceNow with owners, deadlines and fix guidance
- Risk acceptance with expiry dates, compensating controls and approver sign-off
- Trend reports on open findings, time to fix and overdue items by team
DemoInteractive · sample data
Try it live.
A working sample with made-up data. It runs in your browser; nothing is sent anywhere.
- Approved scope: 214 assets, prod-eu
- OpenSSH CVE-2024-6387
- KEV-listed findings
- Overdue criticals
- Container base images
- Unknown hosts
What it does well
Risk-based ranking
Flaws exploited in the wild on internet-facing systems rise to the top of the list.
Owner routing
Each finding reaches the team that owns the asset, not a shared inbox.
Duplicate merging
The same CVE reported by three scanners becomes one finding with three sources.
Fix verification
A finding closes only when a later scan or agent check confirms the fix.
Deadline tracking
Deadlines follow severity, and overdue items escalate to the right manager.
Scoped scanning
Scans run only against assets you own and have approved, inside agreed windows.
Questions
We already have a scanner. Why do we need more?
A scanner tells you what is wrong on the hosts it reached. Vulnerability management adds the rest: which assets were missed, who owns each finding, which ones matter most, what was fixed and what was accepted. We usually keep your scanner and build the layer around it.
How do you decide what gets fixed first?
Severity alone is a poor guide. We combine CVSS with whether the flaw is in the CISA Known Exploited Vulnerabilities catalogue, its EPSS likelihood score, whether the asset faces the internet and how important it is to the business, then agree the weighting with you.
Do you scan systems you do not own?
No. Scans run only against assets listed in a scope you approve in writing, from known addresses, inside agreed time windows. Third-party systems, such as a hosting provider’s shared infrastructure, stay out of scope unless their owner also gives written permission.