Eight capabilities. One shared context.
Each capability answers a different question, but all of them read the same unified model — which is what keeps their answers consistent with one another.
Unified Asset Intelligence
Agentless network discovery and lightweight endpoint agents build one inventory, enriched with owner, criticality and business context.
- Agentless subnet discovery
- Agent-based tracking for roaming devices
- Business context on every asset
Evidence-Based Vulnerability Consolidation
Findings are derived by matching each asset's installed software exactly against NVD, with unconfirmed version ranges flagged rather than guessed.
- Exact software-to-CVE matching
- Unconfirmed versions shown explicitly
- No duplicate findings
Threat Intelligence Correlation
A daily AI-researched threat brief, CISA KEV status and FIRST EPSS scores are correlated with the vulnerabilities on your own assets.
- Daily Threat Brief
- CISA KEV status
- EPSS exploit probability
Security Signal Analysis
Endpoint telemetry is evaluated by detection rules mapped to MITRE ATT&CK, and linked to the open vulnerabilities on the same machine.
- Windows event monitoring
- ATT&CK-mapped detection rules
- Corroborated findings flagged
Contextual Risk Scoring
A weighted scoring engine combines six factors. Observed exploitation (CISA KEV) sets a floor that forces a finding into the Critical tier.
- Six weighted, tunable factors
- KEV exploitation floor
- Every factor visible
Attack Path Intelligence
Scored entry routes from the internet to exposed assets and the vulnerabilities on them, mapped to ATT&CK tactics and kill chains.
- Internet-to-asset entry routes
- Path scores
- ATT&CK and kill-chain mapping
Remediation SLA Policy
Evidence-based deadlines per risk band, with assignment, verification of the fix and tracked exceptions.
- Deadlines per risk band
- Assignment and verification
- Exception tracking
Executive Reporting
Durable PDF and CSV reports, previewed before generation and carrying TLP 2.0 sharing markings.
- PDF and CSV reports
- Preview before generating
- TLP 2.0 markings
What each capability contributes
A closer look at the role each capability plays inside the connected intelligence lifecycle.
Unified Asset Intelligence
Agentless network discovery and lightweight endpoint agents build one inventory, enriched with owner, criticality and business context.
- Agentless subnet discovery
- Agent-based tracking for roaming devices
- Business context on every asset
Evidence-Based Vulnerability Consolidation
Findings are derived by matching each asset's installed software exactly against NVD, with unconfirmed version ranges flagged rather than guessed.
- Exact software-to-CVE matching
- Unconfirmed versions shown explicitly
- No duplicate findings
Threat Intelligence Correlation
A daily AI-researched threat brief, CISA KEV status and FIRST EPSS scores are correlated with the vulnerabilities on your own assets.
- Daily Threat Brief
- CISA KEV status
- EPSS exploit probability
Security Signal Analysis
Endpoint telemetry is evaluated by detection rules mapped to MITRE ATT&CK, and linked to the open vulnerabilities on the same machine.
- Windows event monitoring
- ATT&CK-mapped detection rules
- Corroborated findings flagged
Contextual Risk Scoring
A weighted scoring engine combines six factors. Observed exploitation (CISA KEV) sets a floor that forces a finding into the Critical tier.
- Six weighted, tunable factors
- KEV exploitation floor
- Every factor visible
Attack Path Intelligence
Scored entry routes from the internet to exposed assets and the vulnerabilities on them, mapped to ATT&CK tactics and kill chains.
- Internet-to-asset entry routes
- Path scores
- ATT&CK and kill-chain mapping
Remediation SLA Policy
Evidence-based deadlines per risk band, with assignment, verification of the fix and tracked exceptions.
- Deadlines per risk band
- Assignment and verification
- Exception tracking
Executive Reporting
Durable PDF and CSV reports, previewed before generation and carrying TLP 2.0 sharing markings.
- PDF and CSV reports
- Preview before generating
- TLP 2.0 markings
Scores you can defend in a review
Every score exposes the factors behind it, so a prioritization decision can be explained to an engineer, an auditor or an executive with the same evidence.
How the capabilities run as one sequence
From ingestion through reassessment, each step hands its context to the next.
- 01
Discover
Collectors, agents and connectors find assets and record their installed software.
- 02
Match
Software is matched against NVD to derive the vulnerabilities that apply.
- 03
Deduplicate
Repeated findings are consolidated into single, coherent records.
- 04
Correlate
Findings are related to assets, threat intelligence and signals.
- 05
Contextualize
Criticality, exposure and business context are layered on.
- 06
Score
Contextual risk is calculated from multiple contributing factors.
- 07
Map Paths
Routes from the internet to exposed assets and their vulnerabilities are scored.
- 08
Assess
AI produces explanations and recommendations for review.
- 09
Remediate
Prioritized work moves into structured remediation workflows.
- 10
Reassess
Posture is re-evaluated as conditions and intelligence change.
Deadlines set by evidence
Each risk band carries a deadline. Tasks are assigned, the fix is verified on the next scan, and any exception is recorded with an owner and an expiry.
Posture, communicated
Generate durable PDF and CSV reports from the same model analysts work in, preview them first, and mark them with TLP 2.0 sharing labels.
See these capabilities against your own environment
Request a walkthrough of AegisVMP and see how unified intelligence changes what your team works on first.