Financial Services · Managed platform (Tenable)

Vulnerability Management

Authenticated scanning of your network on a set schedule, with findings triaged and tracked to closure

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Tenable for banks, credit unions and other financial institutions. Tenable scans your network, servers and endpoints on the schedule you set, using credentials so it sees missing patches and weak configurations rather than only open ports. Moraph keeps the scans healthy, triages the findings, routes them to the teams that fix them and reports progress, while your institution decides risk acceptances and remediation priorities.

The problem it solves

Most institutions own a scanner, but scans quietly fail when credentials expire, new subnets go unscanned, and reports with thousands of findings are emailed to teams who cannot tell which matter. Remediation is tracked in spreadsheets, accepted risks are never revisited, and when examiners or auditors ask how often the network is scanned and how quickly critical findings are fixed, the evidence has to be rebuilt by hand.

  • Scans run without credentials or miss parts of the network without anyone noticing
  • Findings arrive in large reports with no owner or priority
  • Remediation and risk acceptances are tracked in spreadsheets
  • Scan coverage and fix times are hard to evidence for examiners and the board

Who uses it

  • Banks, credit unions and other financial institutions without a dedicated vulnerability team
  • Information security officers who answer for the vulnerability management program
  • IT infrastructure and server teams who apply the fixes
  • IT risk and compliance staff who prepare evidence for examiners
  • Internal audit reviewing scanning coverage and remediation

Requirements it supports

Gramm-Leach-Bliley Act Safeguards Rule (16 CFR 314.4(d)(2), vulnerability assessments and penetration testing)Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)FFIEC IT Examination Handbook, Information Security bookletNYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500.5, vulnerability management)NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Tenable provides the scanning platform, Moraph configures and runs it, and your institution fixes the findings and makes the risk decisions.

AreaMoraphTenableYour organization
LicensingSupplies licences as a reseller and tracks asset counts and renewalsSets licence terms, entitlements and pricingAgrees to Tenable's terms and decides how many assets to license
Platform availabilityMonitors scanners and agents and escalates platform issuesRuns its cloud service under its own service commitmentsHosts scanners on-premises and provides network access
ConfigurationSets scan policies, schedules and asset groupsProvides scanning capabilities and vulnerability checksApproves scope, schedules and scan windows
Scan credentialsConfigures credentials in Tenable or your vaultUses credentials during scansCreates and owns the scan accounts
MonitoringChecks every scan run for failures and coverage gapsPublishes service status for its cloudTells Moraph about network changes and new sites
Findings triagePrioritizes, deduplicates and routes findingsPublishes vulnerability checks and priority ratingsConfirms asset criticality and ownership
RemediationVerifies fixes by rescanningNoneApplies patches and configuration changes
Risk decisionsRecords acceptances and tracks expiryNoneApproves remediation targets and risk acceptances
Patches and updatesKeeps scanners and agents currentReleases product updates and new checksApproves maintenance windows for on-premises components
Incident responseEscalates critical exposures to your security officerResolves issues in its own platformDecides on and runs the response

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Tenable itself, which belongs to its vendor.

  1. Step 1

    The onboarding tracker

    During onboarding, each network and asset group is brought into scope, credentialed and baselined.

    Asset groupAssetsScanner or agentCredentialsFirst scanStatus
    Core banking servers64Internal scannerWorkingCompleteBaselined
    Branch workstations410AgentsNot neededCompleteBaselined
    Network devices88Internal scannerFailing on 12PartialFixing credentials
    Internet-facing9External scannerNot applicableCompleteBaselined
    Cloud workloads37Cloud connectorWorkingScheduledIn progress
    During onboarding, each network and asset group is brought into scope, credentialed and baselined.

  2. Step 2

    Scan health

    Every scheduled run is checked, so a scan that ran without credentials does not pass as a clean result.

    Weekly authenticated scan · Core banking servers

    Schedule
    Weekly, Sunday window
    Hosts targeted
    64
    Hosts scanned with credentials
    61
    Authentication failures
    3
    Hosts not reached
    0
    New findings
    17

    Follow-up

    • Scan account locked on 3 hosts after a password change
    • Asset owner asked to reset the account
    • Hosts rescanned once fixed
    Every scheduled run is checked, so a scan that ran without credentials does not pass as a clean result.

  3. Step 3

    Findings triage

    Moraph analysts group findings by fix, set priority and route them to the team that owns the assets.

    FindingHostsSeverityAsset criticalityOwnerDecision
    Web server version with known exploit2CriticalHigh (internet-facing)InfrastructureEscalated now
    Missing operating system update38HighMixedDesktop engineeringTicket raised
    Weak TLS configuration6MediumMediumInfrastructureTicket raised
    Outdated browser plug-in14MediumLowDesktop engineeringTicket raised
    Reported version check on patched host1HighMediumMoraphVerifying false positive
    Moraph analysts group findings by fix, set priority and route them to the team that owns the assets.

  4. Step 4

    A risk acceptance

    When a finding cannot be fixed, the request, compensating controls and approval are recorded with an expiry date.

    RA-0214 · Legacy check-imaging server, unsupported operating system

    1. Fix not possible until vendor upgradeRemediation owner
    2. Compensating controls proposed: network isolation, restricted accessRemediation owner
    3. Controls verified by scan and firewall reviewMoraph vulnerability analyst
    4. Acceptance approved with expiry dateInformation security officer
    5. Reminder scheduled before expiryMoraph vulnerability analyst
    When a finding cannot be fixed, the request, compensating controls and approval are recorded with an expiry date.

  5. Step 5

    The monthly service review

    Each month the service owner and security officer see coverage, remediation and open actions in one pack.

    Monthly service review · Example Federal Credit Union (fictional)

    Assets in scope
    608
    Scanned with credentials
    596
    Critical findings open
    2
    Findings closed this month
    214
    Past remediation target
    11
    Acceptances expiring next month
    1

    Actions agreed

    • Add new branch network to scope
    • Escalate overdue findings on file servers
    • Review expiring acceptance
    Each month the service owner and security officer see coverage, remediation and open actions in one pack.

  6. Step 6

    Access review

    The security officer confirms who can see findings and approve acceptances, and removals are tracked.

    UserRoleScopeLast sign-inDecisionStatus
    User 2201Remediation ownerInfrastructure assetsThis weekKeepConfirmed
    User 2187Remediation ownerDesktop assets140 days agoRemoveRemoved
    User 2150Service ownerAll assetsTodayKeepConfirmed
    Moraph analyst 3Moraph analystAll assetsTodayKeepConfirmed
    User 2099AuditorRead-only, all assetsAccess expiredRemoveRemoved
    The security officer confirms who can see findings and approve acceptances, and removals are tracked.

Workflows

The principal workflows

  1. Discover

    Tenable discovers assets across the networks you put in scope, and Moraph reconciles what it finds with your asset inventory so nothing is left unscanned.

    • Network ranges, cloud accounts and sites in scope agreed with you
    • Scanners and agents deployed where they are needed
    • Discovery scans find live hosts and services
    • Results reconciled with your asset inventory
    • Unknown or unscanned assets raised to your service owner

  2. Scan

    Authenticated scans run on the schedule you approve, such as weekly, and Moraph checks every run for failed credentials and coverage gaps.

    • Scan policies and schedules set per network and asset group
    • Scan credentials stored in Tenable or your privileged access vault
    • Each run checked for authentication failures and missed hosts
    • Failures fixed or raised with the asset owner
    • Configuration audits run against benchmarks you choose

  3. Triage

    Moraph reviews new findings, removes duplicates and known false positives, sets priority using severity, Tenable's priority rating and asset importance, and routes each to an owner.

    • New findings grouped by fix rather than by host
    • Priority set from severity, exploitability and asset criticality
    • Suspected false positives verified before being suppressed
    • Remediation tickets raised for the owning team
    • Critical findings on exposed systems escalated to your security officer straight away

  4. Remediate and verify

    Your teams apply fixes, Moraph rescans to verify them, and findings that cannot be fixed go through a risk acceptance your security officer approves.

    • Owning team applies the patch or configuration change
    • Moraph rescans and closes the finding when the fix is confirmed
    • Overdue findings escalated against the remediation targets you set
    • Risk acceptance requested with compensating controls and an expiry date
    • Security officer approves or rejects the acceptance

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Information security officer

Information security officer, CISO, IT risk manager

Owns the vulnerability management program and decides how risk is handled when a finding cannot be fixed in time.

Sees

  • All findings, assets and scan results across the institution
  • Remediation progress against the targets you set
  • The risk acceptance register
  • Program reporting for management and examiners

Does

  • Sets remediation targets by severity
  • Approves or rejects risk acceptances
  • Approves changes to scan scope that remove assets
  • Decides escalation of overdue findings
  • Presents program results to management and the board

Cannot

  • Approve a risk acceptance they requested themselves without a second approver
  • Delete findings or scan history
  • Edit the audit trail
Approvals
Approves risk acceptances, remediation targets and reductions in scan scope.
Notified about
Critical findings on exposed systems, risk acceptance requests, acceptances expiring, and findings past their target.

Remediation owner

Server administrator, network engineer, desktop engineering lead, application owner

Fixes the vulnerabilities on the systems their team is responsible for.

Sees

  • Findings and tickets for assets their team owns
  • How to fix each finding and which hosts are affected
  • Their team's progress against remediation targets

Does

  • Applies patches and configuration changes
  • Updates tickets with progress and the change made
  • Requests a rescan to verify a fix
  • Requests a risk acceptance with the reason and compensating controls
  • Reports suspected false positives with evidence

Cannot

  • Close a finding without a verifying rescan
  • Approve a risk acceptance
  • Change scan scope, schedules or policies
Approvals
Risk acceptances they request are approved by the security officer.
Notified about
New tickets for their assets, findings approaching or past their target, and verification results.

Service owner

IT manager, infrastructure manager, IT director

Manages the service day to day with Moraph and keeps the scan scope matched to the network.

Sees

  • Scan schedules, scope, coverage and scan health
  • Open findings and remediation progress
  • The monthly service review
  • Licence use against asset counts

Does

  • Approves scan schedules and scan windows
  • Adds new networks and assets to scope
  • Assigns asset ownership to teams
  • Attends the monthly service review and agrees actions
  • Approves Moraph administrative access to Tenable

Cannot

  • Remove assets from scope without the security officer
  • Approve risk acceptances
  • Delete scan history
Approvals
Approves scan schedules and additions to scope; removals from scope also need the security officer.
Notified about
Scan failures not fixed before the next run, unknown assets found, licence limits approaching and vendor service notices.

Moraph vulnerability analyst

Moraph vulnerability analyst, security operations engineer

Runs Tenable for you: keeps scans healthy, triages findings, routes them and verifies fixes.

Sees

  • Tenable configuration, scan results and scan health
  • Findings, tickets and risk acceptances
  • Asset inventory and ownership

Does

  • Configures scan policies, schedules, scanners and agents
  • Checks every scan run and fixes credential or coverage failures
  • Triages new findings, removes duplicates and verifies suspected false positives
  • Raises remediation tickets and escalates critical findings
  • Rescans to verify fixes and prepares service and program reports

Cannot

  • Approve risk acceptances or suppress a finding without a recorded reason and approval
  • Change systems on your network to apply fixes, unless that is separately agreed
  • Reduce scan scope without your approval
Approvals
Scope and schedule changes are approved by your service owner, and risk acceptances by your security officer.
Notified about
Scan failures, critical new findings, verification requests and vendor notices.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews scanning coverage, findings and remediation without being able to change anything.

Sees

  • Scan history and coverage
  • Findings, remediation tickets and their dates
  • The risk acceptance register with approvals
  • Program reports

Does

  • Reads and exports records within their scope, with each export logged
  • Requests further evidence through the security officer
  • Leaves review notes where your institution enables them

Cannot

  • Change, approve, close or delete anything
  • Run scans
  • Keep access after it expires
Approvals
Their access is approved by the security officer, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Executive viewer

Chief information officer, chief risk officer, board risk committee members

Follows the program's results at a summary level.

Sees

  • Coverage and open findings by severity and age
  • Remediation trends against targets
  • Number and age of risk acceptances

Does

  • Reads dashboards and summary reports
  • Receives scheduled reports
  • Asks the security officer for detail

Cannot

  • See host-level detail unless granted
  • Change or approve anything in the service
Approvals
Their access is approved by the security officer.
Notified about
Scheduled summary reports.

Permissions at a glance

ActionSecurityRemediationService ownerMoraph analystAuditorExecutive
Set scan scope and schedulesApprovesNo accessApprovesFullView onlyNo access
Run an ad hoc scanFullNo accessFullFullNo accessNo access
View findingsFullOwn work onlyFullFullView onlyNo access
Triage and prioritize findingsView onlyNo accessView onlyFullView onlyNo access
Update remediation ticketsFullOwn work onlyFullFullNo accessNo access
Close a finding after rescanView onlyNo accessView onlyFullView onlyNo access
Request a risk acceptanceFullOwn work onlyFullFullNo accessNo access
Approve a risk acceptanceApprovesNo accessNo accessNo accessView onlyNo access
Set remediation targetsFullView onlyView onlyView onlyView onlyView only
View summary dashboardsFullOwn work onlyFullFullView onlyView only
View audit trailView onlyNo accessView onlyView onlyView onlyNo access
Manage users and rolesApprovesNo accessFullNo accessNo accessNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph analysts can triage, route and verify findings, but suppressing a finding or accepting a risk always needs a recorded reason and your security officer's approval.
  • Remediation owners see only the findings on assets their team owns. Asset ownership is set during implementation and maintained by your service owner.
  • Every change to scope, schedules, findings and acceptances is recorded with who made it and when, and access is reviewed periodically by the security officer.
  • Staff sign in through your identity provider, and roles can follow its groups. Auditors and examiners get temporary read-only access with a scope and an end date.

Features

What it does

Authenticated scanning

Tenable logs in to Windows, Linux and network devices with credentials you provide, so it reports missing patches and configuration weaknesses.

Agent-based scanning

Tenable agents on laptops and servers report vulnerabilities from devices that are often off the network during scheduled scans.

Scan health checks

Moraph checks each scan run for credential failures, timeouts and hosts that did not respond, and fixes them before the next run.

Asset discovery and reconciliation

Assets Tenable finds are compared with your inventory, and anything unknown or unscanned is raised for a decision.

Risk-based prioritization

Findings are ranked using CVSS severity, Tenable's Vulnerability Priority Rating and the importance of the asset to your institution.

Configuration audits

Tenable checks systems against configuration benchmarks such as the CIS Benchmarks you choose to adopt.

Remediation routing

Findings are grouped by fix and sent as tickets to the team that owns the asset, in your service management tool.

Fix verification

Moraph rescans fixed assets and closes findings only when Tenable confirms the vulnerability is gone.

Risk acceptance register

Findings that cannot be fixed are recorded with the reason, compensating controls, approver and expiry date.

Remediation targets

Target fix times by severity, set by your institution, with overdue findings escalated.

External exposure scanning

Internet-facing addresses you own are scanned from outside your network to show what an attacker could reach.

Executive and exam reporting

Coverage, open findings by age and severity, and remediation trends, prepared for management, the board and examiners.

Integrations

How it connects to your systems

Connects toHowWhat flows
Asset inventoryYour configuration management database or asset list is compared with what Tenable discovers.In: assets, owners and criticality. Out: unknown and unscanned assets.
IT service managementRemediation tickets are created and updated in your service desk tool, grouped by fix and assigned to the owning team.Out: remediation tickets. In: ticket status and notes.
Privileged access vaultScan credentials can be retrieved from your privileged access management tool, such as Moraph's managed Privileged Access Management service, rather than stored in Tenable.In: scan credentials at scan time.
Patch managementFindings are matched to the patches your patch management tool deploys, so verification follows each patch cycle.In: patch deployment status.
Security monitoringVulnerability data forwarded to your SIEM or security operations provider to add context to alerts.Out: assets and open vulnerabilities.
Cloud accountsCloud environments in scope are connected so cloud workloads are discovered and assessed.In: cloud asset inventory.
Single sign-onYour staff and Moraph analysts sign in through your identity provider where Tenable supports it.In: user identity and group membership.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Users sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Remediation owners see their own assets; approving a risk acceptance is separate from requesting one.

Scan credential handling

Scan accounts are least-privilege and can be held in your privileged access vault; Moraph staff do not keep copies.

Encryption and keys

Scan data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Changes to scope, schedules, findings and acceptances are logged with the person and time, and cannot be edited.

Data residency

Scan data is held in the region you choose where the platform offers it: the United States, the United Kingdom or Australia.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Coverage

Scan coverage

For security officer, service owner, examiners

Assets in scope, assets scanned with credentials, assets scanned without credentials, and assets not scanned in the period.

Break down by
Network or site, Asset type, Scan method, Period
Delivered as
Live dashboard; monthly PDF
Used for
Showing that the whole network is scanned, as your program requires.

Scan health

For service owner and Moraph

Each scan run with credential failures, timeouts and hosts not reached, and what was done about them.

Break down by
Scan, Failure type, Network, Run date
Delivered as
Live view; CSV export
Used for
Making sure scheduled scans are complete and trustworthy.

Unknown assets

For service owner and security officer

Assets Tenable found that are not in your inventory, and the decision recorded for each.

Break down by
Network, First seen, Decision
Delivered as
Live view; scheduled email
Used for
Keeping the asset inventory and scan scope complete.

Remediation

Open findings by age

For remediation owners, service owner, security officer

Open findings by severity and age against the remediation targets you set, with overdue items highlighted.

Break down by
Severity, Owning team, Age band, Asset criticality, Target status
Delivered as
Live dashboard; CSV export
Used for
Driving remediation and escalating overdue work.

Remediation performance

For security officer and IT leadership

Findings opened and closed in the period and the time taken to fix them, compared with your targets.

Break down by
Severity, Owning team, Period
Delivered as
Monthly PDF; CSV export
Used for
Showing whether remediation keeps pace with new findings.

Top fixes

For remediation owners

The patches or configuration changes that would close the most priority findings, with the hosts affected.

Break down by
Owning team, Product, Priority
Delivered as
Live view; scheduled email
Used for
Directing effort to the fixes that reduce the most risk.

Configuration audit results

For security officer and server teams

Pass and fail results against the configuration benchmarks you adopted.

Break down by
Benchmark, Asset group, Control, Result
Delivered as
Live view; PDF export
Used for
Tracking hardening of servers and workstations.

Governance

Risk acceptance register

For security officer, auditors, examiners

Every accepted risk with the finding, reason, compensating controls, approver and expiry date.

Break down by
Severity, Owning team, Approver, Expiry
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that accepted risks are justified, approved and revisited.

Program summary

For senior management and the board

Coverage, open findings by severity and age, remediation trends and risk acceptances for the period.

Break down by
Period, Severity, Business area
Delivered as
PDF; scheduled email
Used for
Board and committee oversight of the information security program.

External exposure

For security officer

Internet-facing services found by external scans and the findings on them.

Break down by
Address range, Service, Severity
Delivered as
Live view; monthly PDF
Used for
Prioritizing what an outside attacker could reach.

Monthly service review

For service owner and security officer

Scan health, coverage changes, triage volumes, escalations, licence use and open actions for the month.

Break down by
Month, Network, Action status
Delivered as
PDF; reviewed in a monthly meeting
Used for
Overseeing Moraph's service and agreeing actions.

Exports, access and evidence

  • Tenable's own dashboards remain available to your users; Moraph adds service reporting, the risk acceptance register and program summaries prepared for management and examiners.
  • Every report can be exported to CSV or PDF and scheduled by email to the people entitled to see it.
  • Findings and asset data can be delivered to your SIEM, data warehouse or governance tool for reporting alongside other risk data.
  • Reports respect each viewer's role: remediation owners see their own assets, the security officer sees the whole program, and executives see summaries.
  • Coverage and remediation reports can be run for a past period for audit, and running or exporting a report is recorded.

Deployment

Where and how it runs

Tenable cloud

Tenable Vulnerability Management hosted by Tenable, with scanners and agents in your environment, operated by Moraph.

Tenable on-premises

Tenable Security Center installed in your environment for institutions whose policies keep scan data on-premises, operated by Moraph under logged administrative access.

Existing Tenable deployment

Where you already own Tenable, Moraph reviews it against an agreed baseline and takes over operation.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Scope and inventory

We agree the networks, sites, cloud accounts and asset groups in scope and reconcile them with your inventory. We need network diagrams and an inventory export.

Licensing and deployment

Moraph supplies Tenable licences as a reseller or works with licences you own, and deploys scanners and agents where they are needed.

Credentials

Least-privilege scan accounts are created by your administrators and stored in Tenable or your privileged access vault.

Policies and schedules

Scan policies, schedules and windows are set for each asset group and approved by your service owner.

Ownership and targets

Asset owners are mapped to teams, remediation targets set by your security officer, and ticket routing connected to your service desk.

Baseline and handover

A first full scan establishes the baseline, findings are reviewed with you, and the monthly service review begins.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Tenable. The platform belongs to Tenable, and Tenable's own service commitments, roadmap and outages apply to it.
  • Licences are subject to Tenable's terms, including how assets are counted.
  • Scanning finds vulnerabilities; it does not fix them. Your teams apply patches and configuration changes unless a separate Moraph service covers that.
  • Results depend on the scan credentials and network access you provide. Assets that cannot be reached or logged into are reported as coverage gaps.
  • A scanner only finds vulnerabilities it has checks for. Custom applications need application security testing, which is not part of this service.
  • Scanning is not penetration testing. Where your regulations call for penetration tests, they are arranged separately.
  • Running a scanner does not by itself satisfy GLBA or any other requirement; your institution decides scope, frequency and remediation targets under its own program.
  • Remediation targets and risk acceptances are your institution's decisions; Moraph records and reports them.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Compare your asset inventory with what a discovery scan finds
  2. Check how many hosts your current scans actually log into
  3. Review a sample triage: are findings grouped by fix and routed to the right team?
  4. Walk through a risk acceptance from request to approval and expiry
  5. Ask for a sample program summary and monthly service review
  6. Confirm in the responsibilities table which tasks stay with your teams

Questions

Frequently asked questions

Can scans run weekly?

Yes. Scan frequency is set by your institution for each asset group, and Moraph configures and monitors whatever schedule you approve, weekly or otherwise.

Will Moraph patch our systems?

Not as part of this service. Moraph finds, prioritizes, routes and verifies; your teams apply fixes. Patching can be scoped as a separate managed service.

We already own Tenable. Can you run it?

Yes. Moraph reviews your deployment against an agreed baseline, fixes coverage and credential gaps, and takes over operation.

How is it priced?

Tenable licences are priced under Tenable's terms, usually by asset count, and Moraph's managed service is a subscription based on the size of the environment, with implementation charged separately. See Working with Moraph for what drives a quotation.

Does this satisfy GLBA?

It supports the vulnerability assessment part of your information security program and produces evidence of it. Whether your program meets GLBA and your regulator's expectations depends on your scope, frequency, remediation and the rest of the program, which your institution decides.

Is there an accessibility conformance report?

Ask through the procurement request form at /how-to-buy/request, naming the platform and version you are evaluating, and we will obtain Tenable's current report for you.

Next steps

Evaluate Vulnerability Management

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Vulnerability Management guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Vulnerability Management support guide.

Related products