Vulnerability management
Scanner results with no owner go nowhere. Turn each one into an issue someone owns.
Vulnerability remediation tracking in Acuna GRC. Vulnerability management takes the list of weak spots your scanner finds, gives each one an owner and a deadline, and keeps reminding them until it is fixed. It works with the scanner you already run: Tenable, Qualys, Rapid7, a CSV file or the API.
Vulnerabilities
Sample company · Brenvara AG
Vulnerabilities
Sample company · Brenvara AGThe problem
Why do scanner findings never get fixed on time? Nobody owns them.
A scanner reports one line per vulnerability per asset, often thousands of them. Without an owner, a deadline and someone checking, the same findings come back in every scan.
Our scanner reports thousands of lines and nobody owns any of them.
Fix: one issue per vulnerability, across every affected asset, with an owner.
We promise 14 days for criticals, but nobody checks.
Fix: due dates come from severity, with reminders before and every day after.
Someone marked it fixed. The scanner still sees it.
Fix: only the scanner sets Resolved, never a person, and the same issue reopens if it comes back.
How it works
How does vulnerability remediation tracking work in Acuna GRC? From scanner result to verified fix.
Scanner results come in, each vulnerability becomes one issue with an owner, its due date follows its severity, and only the scanner can mark it fixed. You verify the fix and close the issue.
How do Tenable, Qualys or Rapid7 results get into the GRC tool?
Through a connector that pulls vulnerable items on its own, about every 4 hours, set up under Admin → Integrations. Any other scanner can use Import CSV on the Vulnerabilities page, or push its results through the API with a key that carries the Write vulnerable items scope. New vulnerability records one by hand.
The first load can take a few hours and shows Catching up on the connector card. Each item is identified by its source and the scanner’s own id, so sending it again updates it.
Connectors and API in Integrations and API →How do thousands of scanner findings become work someone owns?
Every vulnerable item of one vulnerability, across all affected assets, becomes one issue of type Vulnerability under Assure → Issues, with an owner and an SLA due date. Only vulnerabilities at or above your severity floor, High by default, raise an issue on their own. Below it, Raise an issue tracks one anyway.
An item with no matching asset shows Not in your asset inventory. Click Link to pick the right asset, and every item from the same scanner host is linked at once.
Linked risks in the risk register, in Operate →How do you track vulnerability remediation SLAs by severity?
Each issue gets a due date from its severity, counted from when the vulnerability was first seen: by default 14 days for critical, 30 for high, 90 for medium and 180 for low. The owner is reminded 7 days before, the day before and every day it is overdue. After 7 days overdue, the vulnerability manager is told too.
Cannot fix it? Click Request exception. An approved exception shows Risk accepted, takes the issue out of the overdue count and stops its reminders until its valid-until date. The issue stays open.
Issues, corrective actions and exceptions in Assure →How do you report vulnerability remediation to management?
With the dashboard strip on the Vulnerabilities page: open items by severity, overdue issues, SLA compliance, mean time to remediate over the last 90 days and a twelve-week trend of items seen and fixed. The same numbers feed your own dashboards as four KPI data sources.
Aiko and your vulnerabilities
Does a vulnerability change a risk's score? Aiko shows the evidence. You decide.
Ask "Does RISK-004 still match its evidence?" and Aiko includes the open vulnerable items on the risk's assets, each with its source and date. It can propose a new impact and likelihood; you click Change Score, one risk at a time.
Swiss experts
Can someone run vulnerability follow-up for us? Yes, CISO as a service.
Done for you: with CISO as a service, our Swiss experts own the remediation follow-up in Acuna GRC and report to you. You decide what gets fixed and what gets accepted.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
Cybersecurity governance expert
Jean-Emmanuel Rodriguez
Cybersecurity governance.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
CEO of Abilene Group
Henri Haenni
Information security and continuity
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youOn Vulnerability management
Our experts run it. You review.
Integrations
Which vulnerability scanners does Acuna GRC connect to? Tenable, Qualys and Rapid7.
Connectors for Tenable Vulnerability Management, Qualys VMDR and Rapid7 InsightVM are live. Any other scanner can send a CSV or push through the API, and a daily summary can go to Microsoft Teams or Slack.
- Scanner connector
Tenable Vulnerability Management
Vulnerable items come in on their own, about every 4 hours, and stay current on every sync.
- Scanner connector
Qualys VMDR
Set up under Admin → Integrations. The first load shows Catching up on the connector card.
- Scanner connector
Rapid7 InsightVM
An item reported fixed is marked fixed; one that comes back is marked reopened.
- CSV and API
Any other scanner
Import CSV on the Vulnerabilities page, or push results with a key that carries the Write vulnerable items scope.
Microsoft Teams
Slack- 100+ connectors in all
Missing a connector? We build it. See Integrations and API
Connects with
How does vulnerability management fit with the rest of Acuna GRC? It feeds your issues and risks.
Items are matched to your asset inventory and listed next to your risks, each vulnerability becomes an issue in Assure, a group head office counts them per subsidiary, and Aiko cites them when it checks a risk.
- TPRM (Supplier Shield)
- Data Privacy
- Cookie Manager
- Trust Center
- AI Governance
- Evaluations
- Group managementCounted per subsidiary
- Staff Portal
- Vulnerability managementYou are here
FAQ
What else do people ask about vulnerability remediation tracking?
Does Acuna GRC scan our systems?
No. Acuna GRC is not a scanner. It brings in results from Tenable Vulnerability Management, Qualys VMDR, Rapid7 InsightVM, a CSV file or the API, and turns them into issues your team owns.
What marks a vulnerable item fixed?
Only the scanner reporting it fixed. An item that simply stops appearing stays open, and a risk your scanner has accepted does not close it: use an exception on the issue instead.
What if an asset is not in our inventory?
The item shows Not in your asset inventory. Click Link in its Asset section to pick the right asset; every item from the same scanner host is linked at once.
Can we change the severity floor and the deadlines?
Yes. Administrators set the severity floor and the time to fix per severity from the cogwheel on the Vulnerabilities page. A change applies the next time items are grouped; open issues keep their due date.
Who is reminded when an issue has no owner?
The vulnerability manager named under Admin → Notifications, or the administrators when none is set.
Can vulnerability updates go to Teams or Slack?
Yes, in the daily channel summary to Microsoft Teams or Slack, once an administrator turns it on. It is a summary, not a two-way sync.
Does everyone see every vulnerable item?
No. An item takes its asset’s scopes once linked, and a user limited to some scopes sees only the items in them.
Is vulnerability management an add-on, and where is our data hosted?
It is an add-on module, switched on per organization. Your data is hosted in Switzerland, the EU or the US.
Start with one step.
Tell us which scanner you run. We'll show you its results in Acuna GRC as one issue per vulnerability, with an owner, a due date and the reminders that follow.
Hosted in Switzerland, the EU or the US