Unified Vulnerability Management

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

What It Does

Unified Vulnerability Management is a Guard product module. It is enabled on every subscription tier, including Freemium.

It is the inventory on Vulnerabilities: one table of risks no matter which scanner produced them. Guard's own Nuclei engine, imported scanner results (Nessus, Qualys, InsightVM, Tenable VM), and application scanners (Burp, Invicti) all land as the same kind of record — a finding tied to an asset, with status, severity, origin, and (when a CVE exists) threat-intelligence enrichment.

This module is not Attack Surface Management (what you own). It is not Cyber Threat Intelligence (how a CVE is scored). Those modules feed this one.

Why It Matters

Scanner output is not a program. Nuclei, Qualys, and Burp each have their own severity, status, and ticket story. Unified Vulnerability Management is the place those streams become one queue you can triage, accept, reject, or send to Jira.

Where findings come from

Nuclei — Guard's production scanner, including CVE templates. High-EPSS/CVSS templates can enter the emergent-threat pipeline.
Vulnerability Management integrations — Nessus, Qualys, InsightVM, Tenable VM.
Application Security Testing — Burp Enterprise, Invicti, and related DAST imports.
File import — Qualys, Nessus, InsightVM, or NSA CSaaS.
Hunts and agents — findings can originate from Hannibal and other capabilities; Origin still names the producer.

Filter the table by Source / Origin to see which tool created a row.

Lifecycle

Status	Meaning
Detected	Found by a scanner or import; awaiting review.
Demonstrated	Validated as a real issue. Can open an ITSM ticket.
Resolved	Fixed. Guard keeps scanning; a reappearance reopens to Demonstrated.
Rejected	Not actionable (false positive, duplicate, out of scope, other).
Accepted	Real finding; risk accepted and kept visible.

Severity: Critical, High, Medium, Low, Info, Exposure.

Internally Guard stores a two-character code (state + severity). Automatic Findings Validation (Cato) matches those codes. You do not type the codes in the table.

How it connects to other modules

Attack Surface Management — every risk is attached to an asset Guard already knows.
Cyber Threat Intelligence — CVE findings pick up CVSS, EPSS, CISA KEV, ATT&CK, and CWE. That module is off on Freemium.
Settings → AI → Automatic Findings Validation — Cato can auto-triage new findings by source and severity. It does not re-run the backlog.
Integrations → IT Service Management — tickets for demonstrated findings.

What this module is not

Not Continuous Penetration Testing (human-validated offensive capabilities).
Not Adversary Emulation / BAS (EDR/SIEM detection outcomes).
Not Red Teaming (Ludacris-only engagement).