An Overview of Vulnerability Manager
Vulnerability Manager helps you identify, prioritize, and resolve security weaknesses across your scanned assets. Once a scan has completed, your results are displayed in the Vulnerability Manager dashboard for that asset. This is where you can review discovered vulnerabilities to better understand their risk levels and take action to remediate them.
What’s Included in Your Dashboard
Your dashboard gives you a summary of all vulnerabilities that found on that asset. This helps you quickly understand which vulnerabilities need attention and where to focus first.
From the dashboard, you can view information such as:
- The scanned asset or IPv4 address
- The assets operating system
- The current scan status
- The number of vulnerabilities found group by severity
- A full list of vulnerabilities that you can sort and filter by:
- Status
- Severity
- Confirmed vs Potential
- Date found
- A link to a full report for each vulnerability
The dashboard is designed to help you move from detection to action. Start by reviewing the highest-severity findings, then work through lower-severity issues based on the importance of the affected asset.
Understanding Vulnerability Severity Levels
Vulnerabilities are grouped by severity to help you decide what to fix first.
The severity levels are:
- Critical
- High
- Medium
- Low
- Very Low
Critical and High vulnerabilities should usually be reviewed first, especially if they affect a public-facing asset or a business-critical system. These findings are more likely to expose the asset to serious risk, such as unauthorized access, data exposure, service disruption or remote compromise.
Medium vulnerabilities should still be investigated, but they may require certain conditions to be present before they can be exploited.
Low and Very Low findings may still be useful because they can highlight weaker configurations, exposed service information or issues that could help an attacker build a more complete picture of your environment.
Severity should not be the only factor you use when prioritising fixes. You should also consider whether the asset is public-facing, whether the vulnerable service is exposed, whether a patch is available, and how important the asset is to your business.
Breaking Down Confirmed vs Potential Vulnerabilities
Scan results may include both confirmed and potential vulnerabilities.
A confirmed vulnerability means the scanner has found enough evidence to report that the issue is present on the asset.
A potential vulnerability means the scanner has detected signs that the issue may be present, but it cannot fully confirm every condition needed to prove it. These findings should still be reviewed because they may represent real risks, especially if the affected service, software version or configuration is present on the asset.
Potential vulnerabilities are not false positives by default. They are findings that need further investigation before you decide whether to remediate, accept or ignore them.
Reviewing a Vulnerability
Each vulnerability result should give you enough information to understand what has been found and what to do next.
A result may include:
- Vulnerability title
- Severity levels
- Common Vulnerabilities and Exposures (CVEs)
- Common Vulnerability Scoring System (CVSS)
- First detected date
- Last detected date
- Impact
- Description of the issue
- Remediation advice (including AI Remediation Guides)
When reviewing a vulnerability, check the affected asset first. An issue rated as Critical on a public-facing production server will usually need faster remediation than the same issue on an isolated test system.
Using Remediation Advice
Remediation advice explains the recommended action to reduce or remove the vulnerability. This may include installing a vendor patch, updating software, disabling an insecure service, changing a configuration, or replacing an unsupported version.
Before making changes, check whether the affected software or service is still required. If it is no longer needed, removing or disabling it may be safer than simply patching it.
For production systems, plan remediation carefully. Some updates may require service restarts, application testing, or scheduled maintenance windows.
Understanding Vulnerability Status
A vulnerability may move through different statuses as scans are completed and fixes are applied.
Common statuses include:
- New: The vulnerability has been detected for the first time.
- Active: The vulnerability is currently detected on the asset.
- Fixed: The vulnerability was previously detected but is no longer found.
- Reopened: The vulnerability was previously fixed but has been detected again.
If a vulnerability still appears after you believe it has been fixed, check that the fix was applied to the correct asset. You may also need to run a new scan before the dashboard reflects the latest state.
Confirming Vulnerability Fixes
Scans run on a regular schedule but for external scans, you can manually trigger them to check whether exposed vulnerabilities have been resolved.
For internal scans, results update after the internal agent checks in and reports the latest system information. Internal scans are configured to run every two (2) hours, but exact timings may vary depending on the asset’s capacity (i.e., the server/device).
If a vulnerability remains active after remediation, review the recommendation again and check whether:
- The correct asset was updated
- The affected service was restarted
- The correct package or software version was patched
- The vulnerable port or service is still exposed
- The issue applies to another component on the same asset