Vulnerability Management

Principal workflows

• Discover: Tenable discovers assets across the networks you put in scope, and Moraph reconciles what it finds with your asset inventory so nothing is left unscanned.
• Scan: Authenticated scans run on the schedule you approve, such as weekly, and Moraph checks every run for failed credentials and coverage gaps.
• Triage: Moraph reviews new findings, removes duplicates and known false positives, sets priority using severity, Tenable's priority rating and asset importance, and routes each to an owner.
• Remediate and verify: Your teams apply fixes, Moraph rescans to verify them, and findings that cannot be fixed go through a risk acceptance your security officer approves.

Who uses it

• Banks, credit unions and other financial institutions without a dedicated vulnerability team
• Information security officers who answer for the vulnerability management program
• IT infrastructure and server teams who apply the fixes
• IT risk and compliance staff who prepare evidence for examiners
• Internal audit reviewing scanning coverage and remediation

Reporting

• Scan coverage, with and without credentials
• Scan health and failures fixed
• Open findings by severity, age and owning team
• Remediation performance against your targets
• Risk acceptance register with expiry dates
• Program summary for management and the board

Features

• Authenticated scanning: Tenable logs in to Windows, Linux and network devices with credentials you provide, so it reports missing patches and configuration weaknesses.
• Agent-based scanning: Tenable agents on laptops and servers report vulnerabilities from devices that are often off the network during scheduled scans.
• Scan health checks: Moraph checks each scan run for credential failures, timeouts and hosts that did not respond, and fixes them before the next run.
• Asset discovery and reconciliation: Assets Tenable finds are compared with your inventory, and anything unknown or unscanned is raised for a decision.
• Risk-based prioritization: Findings are ranked using CVSS severity, Tenable's Vulnerability Priority Rating and the importance of the asset to your institution.
• Configuration audits: Tenable checks systems against configuration benchmarks such as the CIS Benchmarks you choose to adopt.
• Remediation routing: Findings are grouped by fix and sent as tickets to the team that owns the asset, in your service management tool.
• Fix verification: Moraph rescans fixed assets and closes findings only when Tenable confirms the vulnerability is gone.
• Risk acceptance register: Findings that cannot be fixed are recorded with the reason, compensating controls, approver and expiry date.
• Remediation targets: Target fix times by severity, set by your institution, with overdue findings escalated.
• External exposure scanning: Internet-facing addresses you own are scanned from outside your network to show what an attacker could reach.
• Executive and exam reporting: Coverage, open findings by age and severity, and remediation trends, prepared for management, the board and examiners.

Integrations

• Asset inventory: Your configuration management database or asset list is compared with what Tenable discovers.
• IT service management: Remediation tickets are created and updated in your service desk tool, grouped by fix and assigned to the owning team.
• Privileged access vault: Scan credentials can be retrieved from your privileged access management tool, such as Moraph's managed Privileged Access Management service, rather than stored in Tenable.
• Patch management: Findings are matched to the patches your patch management tool deploys, so verification follows each patch cycle.
• Security monitoring: Vulnerability data forwarded to your SIEM or security operations provider to add context to alerts.
• Cloud accounts: Cloud environments in scope are connected so cloud workloads are discovered and assessed.
• Single sign-on: Your staff and Moraph analysts sign in through your identity provider where Tenable supports it.

Deployment

• Tenable cloud: Tenable Vulnerability Management hosted by Tenable, with scanners and agents in your environment, operated by Moraph.
• Tenable on-premises: Tenable Security Center installed in your environment for institutions whose policies keep scan data on-premises, operated by Moraph under logged administrative access.
• Existing Tenable deployment: Where you already own Tenable, Moraph reviews it against an agreed baseline and takes over operation.

Security and privacy

• Single sign-on: Users sign in through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Remediation owners see their own assets; approving a risk acceptance is separate from requesting one.
• Scan credential handling: Scan accounts are least-privilege and can be held in your privileged access vault; Moraph staff do not keep copies.
• Encryption and keys: Scan data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.
• Complete audit trail: Changes to scope, schedules, findings and acceptances are logged with the person and time, and cannot be edited.
• Data residency: Scan data is held in the region you choose where the platform offers it: the United States, the United Kingdom or Australia.

Limitations

• Moraph is not Tenable. The platform belongs to Tenable, and Tenable's own service commitments, roadmap and outages apply to it.
• Licences are subject to Tenable's terms, including how assets are counted.
• Scanning finds vulnerabilities; it does not fix them. Your teams apply patches and configuration changes unless a separate Moraph service covers that.
• Results depend on the scan credentials and network access you provide. Assets that cannot be reached or logged into are reported as coverage gaps.
• A scanner only finds vulnerabilities it has checks for. Custom applications need application security testing, which is not part of this service.
• Scanning is not penetration testing. Where your regulations call for penetration tests, they are arranged separately.
• Running a scanner does not by itself satisfy GLBA or any other requirement; your institution decides scope, frequency and remediation targets under its own program.
• Remediation targets and risk acceptances are your institution's decisions; Moraph records and reports them.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/vulnerability-management. Purchasing routes and company information: www.moraph.com/how-to-buy.