Vulnerability assessment visibility and configuration

Cyber Risk Exposure Management prioritizes assessment for high-impact and medium-impact vulnerabilities (vulnerabilities with an impact score range of 31-100). The strategy helps you focus on the most important remediation tasks to stop potential threat actors from breaching your network. However, visibility into low-impact vulnerabilities (vulnerabilities with an impact score range of 0-30) may also be necessary for your organization to meet compliance requirements or follow internal policies.

Additionally, low-impact vulnerabilities may pose high future risks if new exploit methods emerge. Identifying and addressing low-impact vulnerabilities proactively enhances your security posture and prevents new sophisticated attacks from affecting your organization.

If you do not have a third-party vulnerability assessment tool connected to TrendAI Vision One™, you may configure the TrendAI Vision One™ vulnerability assessment service to assess your internal assets for all vulnerabilities, including low-impact vulnerabilities.

In the Vulnerabilities tab of Cyber Risk Overview → Exposure Overview or the Risk Factors tab in Threat and Exposure Management → Vulnerabilities, click Configure Vulnerability Coverage. You may choose to assess your internal assets for all vulnerabilities or keep the default behavior of scanning for high-impact and medium-impact vulnerabilities only. To understand how impact scores are determined, see Vulnerability impact score.

In Cyber Risk Overview → Exposure Overview, the following vulnerability management metrics display data on all detected vulnerabilities:

• Detected Vulnerabilities: vulnerabilities are calculated and organized by impact score.
  • Internet-facing assets are not currently included in the calculation.
  
• Mean Time to Patch (MTTP)
• Average Unpatched Time (AUT)
• Vulnerable Endpoint Percentage
• Vulnerability Density

In Threat and Exposure Management → Vulnerabilities, data on all detected vulnerabilities is calculated into the vulnerability percentage and Vulnerability density metrics. In the Detected Vulnerabilities table, vulnerabilities are counted based on impact score level. Click the corresponding impact score level to filter detected vulnerabilities by impact score.