AnvesionTech Book a demo

Agent-based vulnerability assessment · VAPT Every CVE on every endpoint — and exactly how to fix it.

Vulnerability assessment software built into DeviceManager, with no extra scanner and no network scanning. The server matches the inventory its agents already report against current threat data from Microsoft, Linux distributions, NVD, CISA KEV and FIRST EPSS, then tells you what to fix first, and by when.

Book a live demo See how it works
  • No extra scanner
  • No network scanning
  • Self-hosted
  • Air-gapped ready

Recreated from the DeviceManager 7.0 Vulnerability Assessment overview. Sample data, for illustration.

How it works

CVE vulnerability management built on the inventory you already have.

01 Inventory

Agents already report what is installed.

Windows build and update revision, Linux packages and installed programs. Nothing new to deploy, nothing probing your network.

02 Threat data

Six sources of current intelligence.

MSRC, Ubuntu notices, distribution advisories (OSV), NVD, CISA KEV and FIRST EPSS. Synced every 12 hours, or imported as a signed bundle.

03 Match and rank

Every finding gets a risk score and a deadline.

Re-evaluated every 30 minutes and on new data. Each finding carries severity, CVSS, KEV, EPSS, a 0–100 risk score and an SLA date.

04 Fix

Remediation runs through Patch Management.

VAPT never installs anything itself. It prepares a deployment with only the needed device-and-patch pairs; approvals and maintenance windows still apply.

05 Verify

Closed only when the device proves it.

Fixed only when the device's own inventory shows the fixed version. A successful deployment is not enough, and the finding re-opens if the vulnerable version returns.

Severity · CVSS · KEV · EPSS

EPSS risk scoring that shows what to fix first.

Every finding carries four signals from the source data. DeviceManager combines CVSS, CISA KEV and FIRST EPSS into one 0–100 risk score, and every list is sorted by it.

Severity
Critical to Low, or Unknown. Microsoft “Important” counts as High.
CVSS
The base score, wherever the source provides one.
KEV
On CISA's Known Exploited Vulnerabilities list: in active use.
EPSS
FIRST's estimated chance of exploitation within 30 days.
Risk
0 to 100, combining CVSS, KEV and EPSS. Fix from the top down.
CVE-2026-90100Open

Windows TCP/IP remote code execution

Windows 10 Pro 22H2 · Windows 11 · 30 devices

Severity Critical
CVSS 9.8
CISA KEV Actively exploitedRequired action: apply vendor updates
EPSS 32.1%chance of exploitation in 30 days
100risk

Ranked first

Top of every list, sorted by risk. SLA due 7 days after first detection.

Sample finding from a DeviceManager 7.0 demo environment.

SLA clocks

Every finding starts its own deadline.

Due dates count from the day a finding is first detected. The targets are fixed in DeviceManager 7.0, and anything overdue lands in the Past SLA tile and filter.

What is covered

Windows, Linux and the apps your users actually run.

An agent-based alternative to running an on-premise vulnerability scanner for your managed endpoints. Only devices with a DeviceManager agent are assessed, and only where the match is reliable.

Windows

Windows 10, Windows 11 and Windows Server 2016 to 2025

Source
Microsoft security updates (MSRC)
Matched by
Windows build and update revision
Confidence
High

Linux

Ubuntu, Debian, RHEL, Rocky Linux and AlmaLinux

Source
Ubuntu security notices, distribution advisories (OSV)
Matched by
Installed package versions
Confidence
High

Windows applications

About 40 widely used programs, from browsers to databases

Source
U.S. National Vulnerability Database (NVD)
Matched by
Installed program and version
Confidence
Medium

The application catalogue includes

  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge
  • Thunderbird
  • 7-Zip
  • WinRAR
  • Notepad++
  • FileZilla
  • WinSCP
  • PuTTY
  • VLC
  • Wireshark
  • KeePass
  • Git
  • Node.js
  • Python
  • .NET runtimes
  • PowerShell 7
  • Adobe Acrobat and Reader
  • Foxit
  • LibreOffice
  • Zoom
  • TeamViewer
  • AnyDesk
  • VNC viewers
  • Docker Desktop
  • VirtualBox
  • PostgreSQL
  • MySQL
  • Apache Tomcat

DeviceManager never guesses.

Programs outside the catalogue are not assessed. A device that can't be assessed reliably keeps its existing findings and is listed on the Overview with the reason. “Can't assess” is never treated as “fixed”.

  • Not assessedWindows update revision not reported: needs the v7 agent
  • Not assessedLinux distribution not reported: needs the v7 agent
  • Stale dataThreat data over 7 days old: a warning banner appears

From finding to fix

Patch remediation, without a second console.

01 The CVE drawer

Every affected device, and its fix.

CVSS vector, CISA's required action for KEV entries and an NVD link, then each device with installed and fixed version, KB or advisory, status and SLA date.

02 What's ready

Know what can ship today.

Fix via Patch Management lists approved patches, patches needing approval, and updates not yet scanned, with shortcuts to Patch Approvals and Compliance.

03 Pre-filled deployment

Only the device-and-patch pairs you need.

Approvals, schedules, maintenance windows and reboot settings apply. Nothing installs until you create it. Applications update from their vendor, e.g. via Package Manager.

04 Per-device view

A plain “How to fix” for every device.

One cumulative update, N packages or N applications, with Ubuntu Pro (ESM)-only fixes flagged. Also on each device's Vulnerabilities tab.

dm.yourcompany.local/vapt
DeviceManager CVE drawer for a critical, actively exploited Windows vulnerability: CVSS 9.8, EPSS 32.1 percent, CISA required action, and 30 affected devices with installed and fixed build numbers, KB, status and SLA due date
KEV · EPSS · CVSS at a glance Installed → fixed, per device Fix via Patch Management (30)
dm.yourcompany.local/patch-hub
DeviceManager Patch Management Create New Deployment form with schedule type, reboot option, maintenance window, deadline and retry settings

Targets · pre-filled from the CVE

  • WIN-DC-0082KB5045332
  • WIN-DC-0010KB5045895
  • IOT-KIOSK-07KB5044457
Maintenance window Reboot settings
dm.yourcompany.local/devices
Vulnerabilities tab of a DeviceManager device details window with the recommended cumulative update and CVE findings, installed and fixed versions and status

How to fix

  • Install the latest cumulative update KB… — it closes every open Windows finding here.
  • Upgrade 3 packages from the distribution's repositories.
  • 1 package is only fixed for Ubuntu Pro (ESM) subscribers.
  • Update 2 applications to their vendor's latest release.

Exceptions and audit

A reason, an expiry and an audit trail.

When a vulnerability can't be fixed yet, or doesn't apply, record a decision instead of leaving it open.

  1. Accept risk or False positiveOn one finding, or for all devices from the CVE drawer.
  2. A reason auditors will readAt least 10 characters, such as the compensating control.
  3. An expiry for accepted riskRequired, one year at most, 90 days by default.
  4. Re-opens by itselfOn expiry or revoke the findings return. Every change is audited.

Evidence on demand: audited CSV export

Current findings with your active filters, including accepted and false-positive ones.

  • device
  • CVE
  • title
  • severity
  • CVSS
  • KEV
  • EPSS
  • risk
  • component
  • installed version
  • fixed version
  • advisory
  • remediation
  • status
  • confidence
  • first seen
  • SLA due

Online or isolated

Air-gapped vulnerability management, signed and sealed.

Connected servers sync threat data every 12 hours. Isolated servers import signed bundles carried across the gap, and accept only a newer one.

online server
# once: create a signing key pair (keep the private key off isolated servers)
$ DeviceManager vapt-bundle keygen --out <folder>
# every week: export a signed threat-data bundle
$ DeviceManager vapt-bundle export --key <private.pem> --out <file.dmvb>
# isolated server: Threat data › Update threat database from a file (offline) › Import
  • Public key, onceAdded to the isolated server's configuration. Your vendor can do it for you.
  • Import up to 1 GBUnder “Update threat database from a file (offline)”.
  • At least weeklyStale data over 7 days old raises a console warning.
  • Re-evaluated every 30 minAnd whenever new data arrives, online or offline.

Automation and access

Tickets, answers and permissions wired in.

Incidents that close themselves

Enable the “Exploitable Vulnerabilities” source and DeviceManager opens one incident per device with an open KEV finding, or one at or above a risk score (90 by default). It resolves when the findings are fixed, accepted or marked false positive.

Ask the AI Assistant

It answers vulnerability questions using only what the asker's role can see, and can prepare a patch deployment to fix a vulnerability. Nothing installs until a person creates it. Explore the AI Assistant

Least privilege by default

Five VAPT permissions on top of DeviceManager's role-based access. Creating the deployment itself also needs the patch deployment permission.

VAPT permissions and default roles
PermissionAllowsDefault roles
Vapt.ViewOpen the page and the device tabSuperAdminAdminManagerEngineer
Vapt.RemediateFix via Patch ManagementSuperAdminAdminManagerEngineer
Vapt.ManageExceptionsCreate and revoke exceptionsSuperAdminAdminManager
Vapt.ExportExport CSVSuperAdminAdminManager
Vapt.ManageFeedsThreat data settings, sync, bundle importSuperAdminAdmin

Questions

Straight answers.

Vulnerability assessment is one module of DeviceManager, the self-hosted endpoint management platform, and covers agent-managed endpoints. For switches, routers and printers that can't run an agent, see network monitoring over SNMP.

Is DeviceManager VAPT a penetration test?
No. It is agent-based vulnerability assessment: it compares what is installed on each managed endpoint with published vulnerability data and tracks every finding to closure. It never attacks or probes your systems, and it complements periodic penetration tests with continuous assessment in between.
Do we need a separate vulnerability scanner or network scanning?
Not for managed endpoints. DeviceManager reuses the inventory its agents already send, so there is no scanner to deploy and no network sweep. Only devices with a DeviceManager agent are assessed.
Which operating systems and applications are covered?
Windows 10, Windows 11 and Windows Server 2016 to 2025; Ubuntu, Debian, RHEL, Rocky Linux and AlmaLinux; and about 40 widely used Windows applications. Programs outside the catalogue are not assessed, because DeviceManager never guesses.
How are vulnerabilities prioritised?
By a 0 to 100 risk score that combines CVSS, CISA KEV and FIRST EPSS, and every list is sorted by it. SLA due dates run from first detection: 7 days for KEV, 15 for Critical, 30 for High, 90 for Medium and 180 for Low or unknown.
Does it work in an air-gapped network?
Yes. Switch online sync off and import signed threat-data bundles (.dmvb) exported from a DeviceManager server with internet access. The isolated server checks the signature and contents and accepts only a newer bundle. Import at least weekly.
Does VAPT install patches by itself?
No. VAPT never installs anything itself. Fix via Patch Management prepares a deployment with only the needed device-and-patch pairs, under your usual approvals and maintenance windows. A finding closes only when the device's own inventory reports the fixed version.

Let's talk

See your own CVE exposure, on your own servers.

A tailored demo of vulnerability assessment on DeviceManager 7.0, a pilot in your environment — online or air-gapped — and a deployment and licensing plan.

Book a live demo
Call us+91 93244 18175 Email usinfo@anvesiontech.com

Sales sales@anvesiontech.comSupport support@anvesiontech.com