Unified Vulnerability Management

How Guard aggregates findings from Nuclei and connected scanners into one risk inventory with a shared lifecycle, origin, and enrichment.

What It Does

Unified Vulnerability Management is a Guard product module. It is enabled on every subscription tier, including Freemium.

It is the inventory on Vulnerabilities: one table of risks no matter which scanner produced them. Guard's own Nuclei engine, imported scanner results (Nessus, Qualys, InsightVM, Tenable VM), and application scanners (Burp, Invicti) all land as the same kind of record — a finding tied to an asset, with status, severity, origin, and (when a CVE exists) threat-intelligence enrichment.

Aurelius describes this pillar as aggregated risk intelligence from integrated scanners (Nuclei, Burp, Tenable, InsightVM, and others). That matches the Origin column and source filters on the Vulnerabilities page.

This module is not Attack Surface Management (what you own). It is not Cyber Threat Intelligence (how a CVE is scored). Those modules feed this one.

Why It Matters

Scanner output is not a program. Nuclei, Qualys, and Burp each have their own severity, status, and ticket story. Unified Vulnerability Management is the place those streams become one queue you can triage, accept, reject, or send to Jira.

Where findings come from

Guard does not only import third-party scans. It also produces findings:

Nuclei — Guard's production scanner, including CVE templates. High-EPSS/CVSS templates can enter the emergent-threat pipeline (broadcast → detect → Hannibal hunt).
Vulnerability Management integrations — Nessus, Qualys, InsightVM, Tenable VM (categories.config.ts).
Application Security Testing — Burp Enterprise, Invicti, and related DAST imports.
File import — Qualys, Nessus, InsightVM, or NSA CSaaS XLSX.
Hunts and agents — findings can originate from Hannibal and other capabilities; Origin still names the producer.

Filter the table by Source / Origin to see which tool created a row.

Lifecycle (what you see in the UI)

Customer-facing statuses on the Vulnerabilities page:

Status	Meaning
Detected	Found by a scanner or import; awaiting review.
Demonstrated	Validated as a real issue. Can open an ITSM ticket.
Resolved	Fixed. Guard keeps scanning; a reappearance reopens to Demonstrated.
Rejected	Not actionable (false positive, duplicate, out of scope, other).
Accepted	Real finding; risk accepted and kept visible.

Severity: Critical, High, Medium, Low, Info, Exposure.

Internally Guard stores a two-character code (state + severity, for example TC = triage/detected Critical). Automatic Findings Validation (Cato) matches those codes. You do not type the codes in the table.

How it connects to other modules

Attack Surface Management — every risk is attached to an asset Guard already knows.
Cyber Threat Intelligence — CVE findings pick up CVSS, EPSS, CISA KEV, ATT&CK, and CWE from the daily enrichment pipeline. That is a separate product module (off on Freemium).
Settings → AI → Automatic Findings Validation — Cato can auto-triage new findings by source and severity. It does not re-run the backlog.
Integrations → IT Service Management — tickets for demonstrated findings.

What this module is not

It is not Continuous Penetration Testing (human-validated offensive capabilities and the annual compliance test).
It is not Adversary Emulation / BAS (EDR/SIEM detection outcomes).
It is not Red Teaming (Ludacris-only engagement; see that article).