See the known flaws in the software you run. Only yours, riskiest first.
Vulnerability management shows which published flaws affect the software you actually use, and which to fix first. List your software, or let us read it from your website, and we match it against every known flaw.
What does it cover? From your software list to your fix list.
Everything starts with the list of software you run. From that one list we build your own ranked set of flaws, keep it scored and tell you when it changes.
Your software list
The products and versions you run, picked from a catalogue of over 181,000 products or found on your website.
Matching
Each tracked product is checked against every published flaw, so you only see the ones that apply to you.
A ranked list
Your matched flaws, ordered by a 0 to 100 risk score that we keep up to date.
Clear bands
Critical, High, Medium, Low or Info on every flaw. Anything confirmed exploited is marked "Emergency patch".
Alerts as soon as we know
We keep watching for new, newly exploited and rising flaws in your software, and tell you by email, in the app or by webhook.
Keyword rules
Catch flaws by text, such as a product and a version together, alongside your tracked software.
Scanner import
Sync findings from Tenable Vulnerability Management, or upload a results file from eight common scanners.
Risk register PDF
Export your matched vulnerabilities as a PDF to share with your team or your board.
AI action plans
Turn your top risks into a written plan of what to fix and in what order.
API and AI assistants
Read your vulnerabilities through the REST API or ask an AI assistant through our MCP server.
How do you tell us what you run? Two ways. Use both.
Most businesses run a mix: a public website, plus systems staff use inside the office. So there are two ways in, and you can use both.
- Let us read it from your website. We identify the software running behind your public site in roughly 5 to 30 seconds, and you review the list before anything is saved.
- Pick it from a catalogue of 37,460 vendors and 181,186 products, down to the version you run. Best for systems that are not on the web.
- We only see what is public. Website detection cannot see anything behind a login, which is why the catalogue is there too.
Website technology detection · Product catalogue
An example of the two ways to tell us what software you run. Choose "From my website" or "From a list" to see each one.
Found on your website Review before saving
- Apache HTTP ServerWeb server2.4.59
- PHPProgramming language8.2.19
- WordPressWebsite builder6.4.3
- jQueryJavaScript library3.5.1
- Google FontsFont service
How does it work? Four steps, all in your browser.
There is no agent to install and nothing to connect to your network. You tell us what you run, in one of two ways, and the rest happens on our side.
- Once, then whenever it changes
Tell us what you run
Let us read your public website, or pick products and versions from the catalogue. You review detected software before it is saved.
- On our side
We match it
Each product you track is checked against every published flaw. The matches become your organisation's vulnerability list.
- Continuously
Your list is ranked
We keep every flaw scored from 0 to 100, so your list stays in order: riskiest first.
- As soon as we know
You hear about changes
We tell you by email or webhook about new or newly exploited flaws in your software. Turn the top of the list into a written plan whenever you need one.
Which flaws affect you? Out of over 400,000.
Over 400,000 security flaws have been published. Almost none of them matter to you. We match the products and versions you track against all of them and keep only the ones that apply.
- Matched to your versions. Each tracked product is checked against the catalogue of known flaws, and the matches become your organisation's list.
- Ranked by a 0 to 100 risk score, kept up to date, so the riskiest flaw is always at the top.
- We keep watching and tell you as soon as we spot newly published flaws, newly known-exploited ones and ones whose exploit likelihood is rising, in the software you track.
- Keyword rules catch flaws by text, such as a product name and a version together.
How the score works, part by part: risk-based prioritisation.
Software matched to published CVEs · Kept up to date
Already run a scanner? Bring its findings in.
If your team already runs a vulnerability scanner, you do not have to start again. Connect it, or upload its results, and the findings are matched to our intelligence alongside your tracked software.
- Tenable Vulnerability Management sync. Connect your Tenable API keys. We verify them, encrypt them and keep your findings in sync, with a pull on demand whenever you like.
- Upload a scan file from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap (XML), OpenVAS or Greenbone (CSV), Qualys VM, Qualys WAS or OWASP ZAP, up to 50 MB.
- Tenable is the only scanner we sync with. For anything else on that list, upload the export.
Webhooks, the REST API and every other connection are on the integrations page.
Tenable sync · Scan-file upload
Yes. You do not need a scanner or a security team to start. List the software you run, or let us read it from your website, and you get a ranked list of the known flaws that affect it. Larger teams can bring in their scanner results too.
No. It runs in your web browser. You tell us what software you use, either by picking it from a catalogue or by letting us detect it from your public website, and the matching happens on our side.
We match each product and version you track against every published flaw. The matches become your list, and each one gets a 0 to 100 risk score that we keep up to date, riskiest first.
Yes. You can connect Tenable Vulnerability Management, which we keep in sync and you can pull on demand, or upload a results file from Nessus, Rapid7 Nexpose or InsightVM, Nikto, Nmap, OpenVAS or Greenbone, Qualys VM, Qualys WAS or OWASP ZAP, up to 50 MB. Tenable is the only scanner we sync with directly.
Yes. We monitor continuously for newly published flaws, newly known-exploited ones and ones whose exploit likelihood is rising, in the software you track, and tell you as soon as we spot one. Alerts go by email, to the bell in the app or to your own tools by webhook.
Vulnerability management watches the software you tell us you run, including systems inside your office. An attack surface scan looks at your domain from the outside to find what is exposed to the internet. Neither is a penetration test.
Know which flaws affect you. And which to fix first.
Tell us what you run, or let us read it from your website, and see only the known flaws that affect it, ranked riskiest first and kept up to date as new ones appear.