Vulnerability Management FAQ
Does it ship with a native vulnerability scanner, and can it perform agent, agentless, network, and credentialed scanning across Windows, Linux, cloud, and network devices?
Unified Security Stack has an integrated vulnerability scanner that relies on three detection engines: Nuclei for network and general scanning, Intel's CVE Binary Tool for agent-based scanning, and a proprietary scanner built in-house for applications.
It supports two deployment models:
Agentless network scanning: Its purpose is external exposure, including open ports, exposed services, web applications, SSL/TLS, and cloud misconfigurations.
Agent-based scanning: Deployed on Windows and Linux hosts to provide deep internal visibility into installed applications and embedded libraries.
The network engine evaluates network-reachable services on cloud and network devices, such as SSH, FTP, SMB, and web consoles. Note that Unified Security Stack does not perform traditional credentialed or authenticated remote scanning; internal host visibility comes from the lightweight agent, not from stored target credentials.
How extensive is its vulnerability intelligence, including CVE coverage, update frequency, and CVSS, KEV, and EPSS scoring?
The coverage comes from a wide range of authoritative feeds, including NVD, Red Hat, OSV, the GitLab Advisory Database, and other sources, all cross-referenced with UTM Stacked Threat Intelligence.
The network engine draws on a community-maintained library of over 12,000 detection templates, and new CVE templates are often released within hours of public disclosure. The binary engine includes hundreds of component checkers for widely used open-source libraries such as openssl, libpng, libxml2, and log4j. Findings include CVSS scores and EPSS exploit-probability data, while recent KEV (known-exploited) coverage exists at the engine level, which supports exploit-aware prioritization instead of raw CVE counts.
Can it perform asset discovery, including for rogue devices and shadow IT?
The scanner operates on specified targets: you scan defined IPs, hostnames, and ranges. It is not a passive or active asset-discovery platform and does not natively identify rogue devices or shadow IT. For visibility into unmanaged assets, Unified Security Stack depends on its wider SIEM telemetry, including log and network data ingestion, rather than on the vulnerability scanner. This scope boundary is intentional.
Can it automate remediation, connect with patch management tools, and generate tickets automatically?
The scanner offers scheduled, recurring scans and a managed remediation workflow with status tracking for Open, Resolved, Mitigated, and False Positive. It does not natively push patches or automatically deploy fixes. Automated ticketing and remediation orchestration occur at the platform level via Unified Security Stack's SOAR and Integrations modules, not within the scanner itself.
Does it offer executive, technical, compliance, and trend reporting on par with Tenable, OpenVAS, or Qualys?
It generates exportable, audit-ready PDF reports filtered by status, which can serve as evidence for auditors and engineering teams, along with a findings dashboard. At present, it does not match Tenable's complete suite of role-tiered executive dashboards, historical trend analytics, and framework-mapped compliance reports. Its reporting is evidence-grade, not analytics-grade.
Can it support compliance frameworks including SOC 2, ISO 27001, HIPAA, NIST, and CIS Controls?
The vulnerability scanner aids compliance programs by providing exportable vulnerability evidence and remediation tracking that support SOC 2, ISO 27001, HIPAA, NIST, and CIS audit requirements. Keep in mind that compliance framework control mapping and reporting come through the broader Unified Security Stack platform; the scanner's role is detection and audit-ready evidence, not native framework-mapped scorecards.