![]() ![]() These vulnerability checks were often rushed out to meet quotas or just to get them in customer hands as quickly as possible. These engineers were given quotas and had to produce a minimum number of these "checks" every month. These checks quickly grew into the tens of thousands. For every vulnerability found in a commercial product, software engineers at each of the scanning vendors would create a piece of code that could detect if a particular system was vulnerable. Vulnerability scanning vendors once competed on how many vulnerabilities each product could discover. Reviewing some of this market's past problems may provide some context for current and future market trends. For those outside the F1000 or Global 2000, however, things might not look that different. I am grateful for the opportunity to examine this market now, six years later.Ĭertainly, for larger organizations, the data produced by vulnerability management products have become just another data point that feed into a larger risk equation. OpenVAS - Open Vulnerability Assessment ScannerĪ little over six years ago, I wrote that "the future is vulnerability management as a feature, not a product.".We recommend reading through the overview before digging into individual reviews, as some thoughts about the space as a whole will be expressed here, to avoid needing to repeat these insights in each individual product review. Reviewsīelow is a list of vendors and products we reviewed, in alphabetical order, which will be published gradually in the days following publication of this overview. ![]() ![]() Looking for the methodology we used to test the products in this category? Click here. ![]() The aim of this report is to share what we’ve learned about the space, to clearly define it as a category, and provide useful context for the individual product reviews that accompany this report. Vulnerability management is too large to tackle all at once, so this round of reviews will focus entirely on commercial and open-source network vulnerability scanners.Īn independent resource operated by the cybersecurity professionals at Security Weekly and built on the foundation of SC Media’s SC Labs, SW Labs is a clearinghouse for useful and relevant product and services information that enables vendor and buyer to meet on common ground. These days, the vulnerability management category has spawned a wide range of sub-categories in application security (SAST, IAST, DAST, SCA, etc.), cloud (container scanning, CSPM), and vulnerability analysis (attack path mapping, risk-based vulnerability management). These early security tools would scan the network for active hosts, would then scan for listening services, and would finally check for vulnerabilities. In the beginning, there were network vulnerability scanners. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |