Finding, tracking and fixing vulnerabilities across hosts, containers and software dependencies with Greenbone, Trivy, Dependency-Track and DefectDojo, and how scan cadence, remediation deadlines and evidence differ by framework and sector.
Scanning images in CI and registries, running clusters and infrastructure as code with Trivy, sending results to DefectDojo, policies that block vulnerable images, and handling base image updates at scale.
Producing SBOMs for every build, tracking components and new CVEs across portfolios with Dependency-Track, VEX to record what is not exploitable, and license risk, for software teams and buyers asking for SBOMs.
For teams with many scanners and spreadsheets: importing Greenbone, Trivy, ZAP and commercial scanner reports into DefectDojo, deduplication, SLAs by severity, ticketing integration and reporting to management.
Keeping vulnerability data current where scanners cannot reach the internet: transferring Greenbone feeds and Trivy databases by controlled media, self-hosting the databases in an internal registry, and scan cadence when updates are manual.
Regulators expect banks to scan, prioritize and fix within set timeframes and to prove it. This page covers scanner coverage across core and cloud systems, remediation SLAs, exception handling and the reports examiners and auditors request.
Hospitals run medical devices and clinical systems that cannot be patched or scanned aggressively. This page covers safe scanning profiles, compensating controls for unpatchable devices, risk analysis under HIPAA and vendor coordination.
Agencies working to remediation deadlines and continuous monitoring rules: authenticated scanning across mixed estates, tracking known exploited vulnerabilities first, and keeping scan data on government infrastructure.
PCI DSS requirement 11.3 calls for quarterly internal and external scans, rescans until high-risk findings are resolved, and ASV scans for external systems. This page covers what Greenbone can cover internally and what still needs an approved scanning vendor.
The Essential Eight patching strategies set scan frequencies and patch deadlines by maturity level. This page maps them to scheduled Greenbone and Wazuh scans, asset discovery and reports that show patch timeliness.
DORA's ICT risk management rules ask EU financial entities for vulnerability scanning and patch management procedures. This page maps them to scanning, tracking and reporting on self-hosted tools and the records supervisors expect.
CIP-010-4 R3 requires periodic paper or active vulnerability assessments of BES Cyber Systems. This page covers when active scanning with Greenbone is safe in control system networks, documenting assessments and tracking remediation plans.
For manufacturers of products with digital elements: the CRA requirements to identify components in an SBOM, handle vulnerabilities and report actively exploited ones, and how Dependency-Track and Trivy support that process.
CMMC Level 2 requires periodic vulnerability scans and remediation by risk (RA.L2-3.11.2 and 3.11.3). This page covers scanning systems in the CUI boundary with Greenbone or Wazuh and the scan and remediation records assessors examine.
ISO 27001 Annex A 8.8 covers management of technical vulnerabilities. This page maps it to scanning, risk-based prioritization and tracking with open-source tools and the evidence a certification auditor samples.
Requirements for a vulnerability management program and toolset: asset coverage, authenticated scanning, container and dependency scanning, feed quality, deduplication, SLAs, ticketing, reporting, and which features need paid feeds or editions.
Questions for scanning vendors and managed vulnerability service providers: coverage and false positive handling, feed sources, scan safety in production, remediation workflow, reporting for auditors and how findings reach engineering teams.
Cost of open-source scanning and tracking run in-house or by a partner against commercial scanner subscriptions: feeds and editions, scanner infrastructure, triage and remediation coordination effort, and reporting work.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.