[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:vulnerability-management":3},{"control":4,"products":24,"stories":65,"lessons":108,"related":133,"compare":146},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":23},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.","Continuous scanning of servers, endpoints, cloud and applications for known vulnerabilities, ranked by whether they are exploited in the wild and how exposed each system is.","Thousands of vulnerabilities are published every month, but only a small share are ever exploited. Prioritising by real exploitation, for example CISA's Known Exploited Vulnerabilities list, puts scarce patching time on the flaws attackers actually use, and gives management a clear picture of exposure.",[11,12,13,14],"Does it prioritise by active exploitation and exposure, not only by CVSS score?","Does it cover cloud, containers and network appliances as well as servers?","Can it track time to fix per team against our targets?","How does it find assets we did not know we had?","Risk: known, exploited vulnerabilities stay open on exposed systems. Control: continuous scanning with exploitation-based priorities and fix deadlines. Owner: vulnerability management lead. Measure: time to fix known-exploited vulnerabilities.",[17,18,19,20],"NIS2 Art. 21(2)(e): vulnerability handling and disclosure","DORA Art. 25: vulnerability assessments and scans","CIS Control 7: continuous vulnerability management","ISO\u002FIEC 27001:2022 A.8.8: management of technical vulnerabilities",{"name":22,"slug":5},"Vulnerability Management","2026-10-16T12:48:06.88634+00:00",[25,33,41,49,57],{"vendor_slug":26,"vendor_name":27,"vendor_logo":28,"product_slug":29,"product_name":30,"url":31,"description":32},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":34,"vendor_name":35,"vendor_logo":36,"product_slug":37,"product_name":38,"url":39,"description":40},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":42,"vendor_name":43,"vendor_logo":44,"product_slug":45,"product_name":46,"url":47,"description":48},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"total":66,"last_days":67,"recent":68},2214,950,[69,74,79,84,89,94,99,104],{"slug":70,"title":71,"published_at":72,"brief":73},"hackers-exploit-siteguard-waf-flaw-to-run-commands-as-admins-de332a","Hackers exploit SiteGuard WAF flaw to run commands as admins","2026-10-18T14:23:16+00:00","Hackers exploit SiteGuard WAF flaw to run commands as admins.",{"slug":75,"title":76,"published_at":77,"brief":78},"drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon-978985","Drupal patches critical RCE flaws, warns exploits may emerge soon","2026-10-17T14:32:48+00:00","Drupal patches two critical RCE vulnerabilities in Field UI and Entity List modules.",{"slug":80,"title":81,"published_at":82,"brief":83},"malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-219fd9","MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","2026-10-17T11:11:56+00:00","Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.",{"slug":85,"title":86,"published_at":87,"brief":88},"beyondtrust-remote-support-zero-day-continues-trend-of-exploited-edge-bugs-92a3ec","BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs","2026-10-16T20:34:37+00:00","BeyondTrust Remote Support zero-day vulnerability is being actively exploited.",{"slug":90,"title":91,"published_at":92,"brief":93},"critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-eef67d","Critical BlockStrap flaw lets hackers run code on Magento servers","2026-10-16T20:00:59+00:00","Critical BlockStrap flaw in Magento and Adobe Commerce allows arbitrary code execution.",{"slug":95,"title":96,"published_at":97,"brief":98},"researchers-demonstrate-openbsd-root-exploit-chaining-37-year-old-shared-memory--ebaf37","Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug","2026-10-16T17:48:45+00:00","OpenBSD root exploit chains 37-year-old bug with kernel flaw, bypassing protections.",{"slug":100,"title":101,"published_at":102,"brief":103},"cisa-adds-two-known-exploited-vulnerabilities-to-catalog-ae4608","CISA Adds Two Known Exploited Vulnerabilities to Catalog","2026-10-16T12:00:00+00:00","CISA adds two actively exploited vulnerabilities to its KEV Catalog, urging federal agencies to prioritize patching.",{"slug":105,"title":106,"published_at":102,"brief":107},"cisa-urges-patching-critical-vulnerability-in-beyondtrust-remote-support-90ef0f","CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support","CISA warns of critical BeyondTrust Remote Support vulnerability CVE-2026-102764, urging immediate patching.",[109,113,117,121,125,129],{"slug":110,"title":111,"published_at":112},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",{"slug":114,"title":115,"published_at":116},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":118,"title":119,"published_at":120},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":122,"title":123,"published_at":124},"critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","2026-10-16T22:21:05.267+00:00",{"slug":126,"title":127,"published_at":128},"beyondtrust-zero-day-highlights-critical-risk-of-unpatched-edge-devices","BeyondTrust Zero-Day Highlights Critical Risk of Unpatched Edge Devices","2026-10-16T22:20:18.59+00:00",{"slug":130,"title":131,"published_at":132},"active-exploitation-of-fortinet-and-beyondtrust-flaws-highlights-patch-urgency","Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency","2026-10-16T20:21:00.599+00:00",[134,138,142],{"slug":135,"name":136,"problem":137},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":139,"name":140,"problem":141},"penetration-testing","Penetration testing and bug bounty","Someone friendly finds the holes before someone hostile does.",{"slug":143,"name":144,"problem":145},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",{"tenable\u002Ftenable-vulnerability-management":147,"qualys\u002Fvmdr":161,"rapid7\u002Finsightvm":177,"holm-security\u002Fholm-security-platform":190,"axonius\u002Faxonius-exposures":198},{"hq_country":148,"also_provides":149,"reviews":150,"affected":160,"reported":160},"US",[],[151,154,157],{"label":152,"url":153},"PeerSpot: Tenable Vulnerability Management user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Ftenable-vulnerability-management-reviews",{"label":155,"url":156},"Gartner Peer Insights: Tenable Vulnerability Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ftenable-vulnerability-management",{"label":158,"url":159},"PeerSpot: Tenable OT Security user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Ftenable-ot-security-reviews",0,{"hq_country":148,"also_provides":162,"reviews":163,"affected":160,"reported":176},[],[164,167,170,173],{"label":165,"url":166},"MITRE ATT&CK Evaluations Enterprise 2024 (ER6): Qualys endpoint results","https:\u002F\u002Fevals.mitre.org\u002Fresults\u002Fenterprise\u002F?vendor=qualys&scenario=2&evaluation=er6&view=individualParticipant",{"label":168,"url":169},"PeerSpot: Qualys Exposure Management user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fqualys-exposure-management-reviews",{"label":171,"url":172},"Gartner Peer Insights: Qualys VMDR user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fqualys-vmdr",{"label":174,"url":175},"PeerSpot: Qualys TruRisk Eliminate user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fqualys-trurisk-eliminate-reviews",14,{"hq_country":148,"also_provides":178,"reviews":179,"affected":160,"reported":189},[],[180,183,186],{"label":181,"url":182},"Gartner Peer Insights: InsightVM user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Finsightvm",{"label":184,"url":185},"PeerSpot: Rapid7 InsightVM user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Frapid7-insightvm-reviews",{"label":187,"url":188},"PeerSpot: Rapid7 MDR user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Frapid7-mdr-reviews",16,{"hq_country":191,"also_provides":192,"reviews":194,"affected":160,"reported":160},"SE",[193],{"slug":135,"name":136},[195],{"label":196,"url":197},"Gartner Peer Insights: Holm Security Next-Gen Vulnerability Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fholm-security-next-gen-vulnerability-management",{"hq_country":148,"also_provides":199,"reviews":200,"affected":160,"reported":160},[],[201,204],{"label":202,"url":203},"PeerSpot: Axonius user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Faxonius-reviews",{"label":205,"url":206},"Gartner Peer Insights: Axonius Asset Cloud user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Faxonius-asset-cloud"]