One model beneath every view
AegisVMP is built around a single, shared representation of your environment. Every capability reads from it and writes back to it, which is why context survives the journey from ingestion to remediation.
Named sources, not vague categories
Findings are derived by matching software inventory (and Tenable.io asset discovery) against public catalogues — AegisVMP does not import findings from third-party scanners.
- NIST NVD
- CISA KEV
- FIRST EPSS
- Microsoft Entra ID
- Azure VMs
- Tenable.io
- AegisVMP Endpoint Agents
- AegisVMP Site Collectors
Three ways assets come in
Use one or all three. Every route ends in the same inventory.
Site Collector
An agentless collector placed on a network segment sweeps subnets and inspects machines remotely over the registry and SSH to record installed software.
Endpoint Agent
A lightweight Windows service for laptops and servers that roam off the network. It reports software and security events wherever the device is.
Connectors & Imports
Pull devices from Entra ID, virtual machines from Azure and assets from Tenable.io, or import CSV and CycloneDX software bills of materials.
Sources in, intelligence out
The platform sits above existing security tooling, consolidating what those systems produce and returning prioritized, explainable outcomes.
Sources
- Collectors, agents & connectors
- NVD vulnerability catalogue
- Endpoint telemetry
- CISA KEV · EPSS · threat brief
AegisVMP Intelligence Core
- Software-to-CVE matching
- Exposure calculation
- Contextualization
- Contextual risk scoring
One data model shared across every view
Outcomes
- Prioritized findings
- Attack path intelligence
- AI assessment
- Remediation workflow
Five layers, one continuous path
Nothing is bolted on. Each layer depends on the completeness of the one beneath it.
- 01
Data layer
Collectors, agents and connectors record assets and their software. NVD, CISA KEV and FIRST EPSS are synchronized as public catalogues.
- 02
Correlation layer
Installed software is matched against NVD to derive findings. Endpoint telemetry is linked to the same assets.
- 03
Context layer
Asset criticality, exposure and business context are applied, turning technical findings into organizational meaning.
- 04
Intelligence layer
Contextual risk scoring, attack path analysis and AI assessment operate on the unified model rather than on isolated feeds.
- 05
Action layer
Prioritized outcomes move into remediation workflows and reporting views used across the organization.
From raw data to reassessment in ten steps
The operating flow of the platform, from the moment data arrives to the point where posture is re-evaluated.
- 01
Discover
Collectors, agents and connectors find assets and record their installed software.
- 02
Match
Software is matched against NVD to derive the vulnerabilities that apply.
- 03
Deduplicate
Repeated findings are consolidated into single, coherent records.
- 04
Correlate
Findings are related to assets, threat intelligence and signals.
- 05
Contextualize
Criticality, exposure and business context are layered on.
- 06
Score
Contextual risk is calculated from multiple contributing factors.
- 07
Map Paths
Routes from the internet to exposed assets and their vulnerabilities are scored.
- 08
Assess
AI produces explanations and recommendations for review.
- 09
Remediate
Prioritized work moves into structured remediation workflows.
- 10
Reassess
Posture is re-evaluated as conditions and intelligence change.
Discover through Reassess
Select a stage to see what it contributes and what it passes to the next.
- Loops back to Discover
Discover
Find assets with collectors, agents and connectors, and record their software.
Consolidate what exists across the environment so every later decision starts from a shared, complete picture.
Hosted, isolated, containerized
How AegisVMP is delivered and how each organization's data is kept apart.
Hosted and multi-tenant
AegisVMP runs as a hosted service. Each organization is a separate tenant, provisioned through the Operator Console.
Isolated by design
Tenant data is separated in the database with row-level security enforced on every tenant table.
Container architecture
The console, API, workers and database run as separate containers. Collectors and agents run inside your network and connect outbound.
Deployment options for your environment are discussed during a demo.
Findings, matched to assets
Every finding links a vulnerability to the asset whose software it affects, with the evidence for the match and any unconfirmed version range shown plainly.
Walk the platform end to end
Request a walkthrough of AegisVMP and see how unified intelligence changes what your team works on first.