Fixing the vulnerabilities that are actually being exploited, first

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

VulnSight matches the software inventory TotalHeal agents already report against a mirrored vulnerability knowledge base. Every finding has a confidence level and an explained 0–100 risk score built from exploitation evidence, so teams fix what attackers use — without a scanner appliance or stored credentials.

2The challenge

Teams cannot patch everything. They need to know which installed software on which device carries a known vulnerability, which are actually being exploited, and which open a path to their most important systems — without deploying a scanner appliance or handing out admin credentials.

The TotalHeal approach. Agentless matching on the TotalHeal server: the software inventory the TotalHeal agent already reports is matched against a mirrored vulnerability knowledge base. Nothing extra runs on the endpoint and no scanning credentials are stored.

3Architecture

4How it works

1. InventoryAgents report installed OS packages and applications.
2. MatchSoftware is matched to distro advisories and NVD data, with a confidence level.
3. RankAn explained 0–100 risk from CVSS, KEV, exploits, EPSS, exposure, live alerts and asset criticality.
4. ActCreate a patch task through UEM, or accept the risk with a second person’s approval.
5. CloseFindings resolve on their own when no longer matched.

5Capabilities in detail

• Linux distro advisoriesDebian, Ubuntu (including Ubuntu Pro ESM fixes), Alpine, Red Hat, AlmaLinux and Rocky Linux packages matched against distro advisories.
• Windows, macOS and desktop appsOS builds and about 98 curated desktop applications matched against NVD data. Unmapped apps are reported as “not assessed”, never guessed.
• Confidence on every findingConfirmed, likely or possible — “possible” is shown apart and never counted.
• An explained 0–100 risk scoreCVSS, CISA KEV (including ransomware use), public exploits, FIRST EPSS, internet exposure, live alerts naming the CVE and asset criticality.
• Explore and graphCVE explorer, per-device view, CVE detail and a graph from device to software to CVE to ATT&CK technique.
• Risk acceptance with a second personExceptions need a reason and an expiry of at most 365 days, are approved by a different person, revocable and audited.
• From finding to fix“Create patch task” raises an update request through UEM — nothing changes automatically. Findings resolve by themselves when no longer matched.
• Exposure management (Enterprise)Asset exposure score, attack surface, attack paths to crown jewels, crown-jewel tagging and a remediation queue.

6Security and data handling

• No scan credentialsNothing is scanned remotely and no administrator credentials are stored.
• Never guessedUnmapped applications are reported as not assessed; possible matches are shown apart and never counted.
• Nothing changes on its ownPatch tasks go through approval; exceptions need a second person and expire.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A software-inventory source: today the TotalHeal agent (desktop or Linux server) with its UEM module enabled
• Recommended: Patch Management to act on findings
• A Sttiz account for each console user

Start a 30 days trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.