How to turn a vulnerability scan export into a client-ready report
Which file to export from Nessus, Greenbone / OpenVAS, Qualys, Rapid7 and Nuclei, how to check it, and how to turn it into a prioritized report a clie
#vulnerability-management
Posts tagged #vulnerability-management
Why your OpenVAS PDF report is missing CVEs (and how to fix it)
Greenbone / OpenVAS PDF reports often drop CVE details or whole results. Here is why it happens, how QoD filters hide findings, and which export to us
Vulnerability remediation timelines: how to set SLAs for clients
How fast should Critical, High and Medium vulnerabilities be fixed? Common remediation timelines, what frameworks require, and a starting SLA matrix M
Vulnerability scan vs penetration test: what's the difference?
A vulnerability scan finds known weaknesses automatically; a penetration test proves what an attacker could do with them. When clients need each, and
How often should you run vulnerability scans? PCI DSS, HIPAA, CIS and insurance
Quarterly is the compliance floor, monthly is the practical baseline. What PCI DSS, HIPAA, CIS Controls and cyber insurers expect, and how to set a sc
CVSS vs EPSS vs CISA KEV: how to prioritize vulnerabilities
CVSS measures severity, EPSS predicts exploitation and CISA KEV confirms it. What each score means, where each falls short, and a practical order for
