01
Finding
Bring in scanner, endpoint, cloud, package, and external-exposure evidence while keeping the original source attached.
VitalSec platform
VUMA™
Vulnerability Management & Automated Assurance
Turn vulnerability findings into verified corrections.
VUMA takes findings from the security tools already in your environment, determines which ones actually apply, puts the important work first, applies supported fixes automatically when they are already approved, and retests before closing the finding.
VUMA combines vulnerability findings with asset, identity, and threat context to prioritize remediation.
Observe · prioritize · auto-remediate within authority · retest · prove
Evidence in. Verified state out.
The scanner is a sensor, not the workflow.
VUMA keeps the original source attached, adds environmental context, coordinates or executes the approved action, and then asks the relevant source or endpoint what is true now.
Vulnerability scanners
Findings, severity, affected software and source evidence
Endpoint + EDR
Observed endpoint, package, configuration and control state
Cloud + network
Exposure, configuration and reachable-service context
Asset + identity
Ownership, business value, privilege and environment context
Threat intelligence
Known exploitation, adversary and external-exposure context
Rusty + connected tools
Authorized execution and independent post-change evidence
Source evidence
Finding + severityOBSERVED
Asset + packageATTACHED
Original sourceKEPT
VUMA
Prioritize + fix
Put the real exposure first. Apply supported fixes automatically when the customer has already approved them; otherwise send the work to the responsible team.
What happened after the fix
Fix applied or assigned
System checked again
Finding closed only if the fix worked
Evidence kept
Why VUMA exists
Scanner output is an input. Closure is an outcome.
A scanner can tell you what it observed. It does not, by itself, decide whether the finding matters in this environment, carry out an authorized correction, or prove that the exposure is gone afterward.
Typical failure mode
Finding → ticket → closed
Different sources create overlapping queues with different identifiers and severity language.
Priority often stops at CVSS or whatever the source product placed at the top.
The remediation record can close without a fresh observation of the affected condition.
VUMA operating standard
Finding → context → action → retest → proof
Keep the original source evidence with the finding.
Determine applicability and materiality in the real environment.
Execute automatically where a supported correction has already been authorized.
Read the relevant state again before closure.
Automated remediation
Automate approved remediation.
VUMA can apply supported fixes automatically when the customer has already approved them. Rusty can make supported endpoint changes, and connected management tools can make other approved changes.
If VitalSec cannot make the change, or the change still needs approval, the work stays with the responsible team.
AUTHORIZED
Execute → retest → prove
A pre-approved supported fix can run automatically. VitalSec then checks the affected system again, and the finding stays open unless the new evidence shows the problem is resolved.
REQUIRES DECISION
Route → approve → execute
Anything VitalSec is not allowed or able to change stays visible and goes to the person or tool responsible for it. VitalSec does not expand its own permissions.
The VUMA lifecycle
One finding. One traceable path to a defensible result.
The same finding carries its source, decision context, action, retest, and closure evidence all the way through.
02
Context
Determine whether the finding applies, how exploitable and reachable it is, which asset it affects, what controls surround it, and how current the evidence is.
03
Priority
Move the findings that matter to the front instead of treating every CVE as the same operational problem.
04
Auto-remediate
Apply supported fixes automatically when the customer has already approved them. Anything else stays with the responsible team for approval or manual action.
05
Retest
Read the relevant source or endpoint again after remediation instead of accepting a ticket status as technical proof.
06
Closure
Close the finding only when newer evidence supports the required state; otherwise keep it unresolved.
Prioritization
Why this finding first?
VUMA helps teams get from a finding to the right action faster. That requires more than sorting a CVE list by severity.
Observed finding
Critical vulnerability on an exposed identity system
Context signal 1
Known exploitation
Context signal 2
Internet reachable
Context signal 3
High-value asset
Context signal 4
Weak compensating control
Operational priority
Context moves this finding ahead of a severity-only queue.
ACT NOW
Exploitability
Known exploitation and threat context change the urgency of a finding.
Exposure
Internet reachability, attack path, and environmental placement change what an attacker can actually touch.
Materiality
A finding on a critical clinical, identity, backup, or administrative system is not equivalent to one on an isolated low-value asset.
Control context
Compensating controls, endpoint state, identity, and surrounding defenses change the practical risk of the same vulnerability.
Validated closure
Verify the exposure changed as intended.
A successful command or closed ticket does not establish that a vulnerability is resolved. VUMA closes the finding only when newer evidence shows the required state.
Retest after a material change. If the evidence does not support closure, the finding stays open.
Before
Observed state
affected package / exposed service
Current status
Fix required
Closure confidence
Not established
After retest
Newer source evidence
required state observed
Finding state
Validated closed
Evidence path
Preserved in Evidence Continuity
Operational value
VUMA turns findings into verified corrections.
01
One finding from discovery through closure
Source evidence, ownership, remediation, retest, and closure stay attached to the same finding instead of being split across scanner consoles and tickets.
02
A real closure standard
Closed means the relevant condition was observed again and the newer evidence supports closure. A completed task, command receipt, or disappeared alert is not automatically enough.
03
Evidence already attached
Keep the original finding, the decision, the fix, the retest, and the evidence showing what changed together in Evidence Continuity and risk measurement.
Evidence sources
VUMA starts with the evidence you already have.
VUMA does not replace scanners or other security sources. It combines their observations with endpoint, threat, identity, asset, control, cloud, and network context, then follows the work through remediation and retest.
Explore specific integrationsVulnerability scanner findings and portable scan evidence
Endpoint, software, package and configuration state
Cloud, network and external-exposure evidence
Threat intelligence and known-exploitation context
Asset, identity, ownership and business-criticality context
Control evidence and authorized remediation state
From finding to verified correction.
See how Rusty can automatically execute supported, pre-approved endpoint corrections and how Evidence Continuity preserves the evidence showing what changed afterward.