Assessing vulnerabilities can help reduce risk in your environment. You can view the full context of any individual vulnerability that exists on an asset, including CVSS score details, and see how the vulnerability impacts your environment.

Accessing Vulnerabilities depends on your system configuration:
  • If you do not have Carbon Black Container enabled, click Vulnerabilities in the left navigation pane.
  • If you have Carbon Black Container enabled, navigate to Harden > Vulnerabilities in the left navigation pane.
Table 1. Accessing Vulnerabilities
Accessing Vulnerabilities when Carbon Black Container is not enabled Accessing Vulnerabilities under Harden when Carbon Black Container is enabled
Accessing vulnerabilities when Carbon Black Container is not enabled. Accessing vulnerabilities under Harden when the Container Security feature is enabled.

The Vulnerabilities page shows vulnerability data across the following asset deployment types:

  • Workloads
  • Endpoints
  • Container Images (if Carbon Black Container is enabled)
  • VDI
  • AWS
  • GCP
  • Azure

Vulnerability data for each customer organization is collected on a 24-hour schedule. Newly added virtual machines (VMs), endpoints, and Public Cloud instances to your inventory typically collect data within minutes.

For non-persistent VDIs that stop before their organization's second scheduled data collection, no vulnerability assessment takes place. For persistent VDIs that run through the second scheduled data collection of their organization, vulnerability assessment takes place within 48 hours of VDI creation.

The Vulnerability Management solution assesses golden images from which clones are deployed and persistent clones that exist for 24 hours or more. When new clones are deployed from a clean and up-to-date golden image, they contain the latest patches that address known vulnerabilities.

For AWS, GCP, and Azure instances, identification criteria is 8 hours; therefore, persistent instance data collection can take up to 32 hours.

Instances can have multiple vulnerabilities, each with a different CVSS score. Based on this score, vulnerabilities are filtered on the level of severity: critical, important, moderate, or low. The higher the score, the higher the severity.