NIS2, DORA, ISO 27001, SOC 2 and the Cyber Resilience Act all ask the same thing in different words: show that you know what you run, that you find out when it is vulnerable, and that you act on it deliberately. vulneraibility.com makes that process repeatable and keeps the record.
Applications with their components and versions, maintained by the teams who own them, and used every day to match new vulnerabilities.
Matching, version checks and prioritisation follow written rules, published in the report methodology.
Every status change records who, when, from where and the justification as it stood at that moment. Notes cannot be silently rewritten in the history.
The executive report doubles as periodic evidence: posture, decisions, programme health and the actionable list on a given date.
Applications, components and versions.
New CVEs matched as they are published.
Version checks and exploitation signals, by written rules.
Fix, accept or defer, with a justification.
History with author, date, source and note.
No tool does on its own. Frameworks ask for a working process, accountable people and evidence. vulneraibility.com supports the process and produces the evidence: inventory, identification, evaluation, treatment decisions and their history.
Any framework that expects technical vulnerability management: ISO/IEC 27001:2022 (control A.8.8), NIS2 (Article 21), DORA (ICT risk management), SOC 2 (CC7.1) and the vulnerability handling obligations of the EU Cyber Resilience Act for manufacturers.
Yes. Each transition stores the previous and new status, the note as written at that moment, the author, the time and whether it came from the dashboard, the API or an AI assistant through MCP.