What it is (plain English)
Turns raw vulnerability-scanner output into prioritized, assignable remediation work. It ingests findings (from Qualys, Tenable, Rapid7, etc.), matches them to assets in the CMDB, prioritizes by real risk, and drives fixes through to closure — so teams patch what matters instead of drowning in a scanner's export.
Problems it solves
- Scanners producing tens of thousands of findings with no prioritization.
- No link between a vulnerability and the asset, owner, or business impact.
- Remediation that isn't tracked or verified.
- Security and IT ops working from different lists.
What must exist first
Platform Core Setup and CMDB Foundation (findings must map to assets/owners). Discovery greatly improves asset matching. Scanner integrations are required.
What the customer needs to provide
- Your vulnerability scanner(s) and how they'll integrate.
- Asset ownership data so findings can be assigned.
- Your risk-prioritization and SLA expectations for remediation.
- The relationship between security and IT remediation teams.
Where it can go next
Remediation flows through Change Management; exploited vulnerabilities link to Security Incident Response (SIR); risk-based prioritization matures with threat intel and asset criticality.