Beareye · Exposure
Vulnerability management: detect, prioritise and track remediation
By Steven Carrier Updated on
Beareye’s vulnerability management detects the flaws reported by all its engines, puts them back in the context of the asset concerned, then prioritises them by real exploitability and business criticality rather than by a raw score. Each vulnerability gets an action plan and a ticket, and a replay after the fix confirms that the remediation holds.
- Prioritised by exploitability
- MTTR tracking
- Developed in France
500 vulnerabilities to sort, no clear priority
A scanner produces hundreds of vulnerabilities ranked by a generic score. Analysts spend their time sorting them, without knowing which ones an attacker would actually exploit in their environment. This noise wears teams out and delays the fixes that matter. Beareye puts each vulnerability back in the context of its asset.
Which vulnerabilities does Beareye centralise?
Beareye centralises CVE, web, network, DNS, certificate and leak vulnerabilities, as well as those in Azure and Active Directory environments. Instead of checking one tool per domain, the team works from a single consolidated list, linked to assets and attack paths .
-
CVE
Published vulnerabilities affecting your software and equipment.
-
Web vulnerabilities
Application flaws in your exposed websites and services.
-
Network and DNS
Open services, network configurations and risky DNS records.
-
Certificates
Certificates that are expired, misconfigured or close to expiry.
-
Leaks
Organisation credentials and data found outside its perimeter.
-
Azure and Active Directory
Misconfigurations and excessive privileges in directories and the cloud.
How should you prioritise vulnerabilities for remediation?
Beareye combines several signals to prioritise: the technical score of the vulnerability, its probability of exploitation, its known exploitation status, the criticality of the affected asset and its place in an attack path. A medium vulnerability on an exposed pivot asset comes before an isolated critical one. To go further: Assessing CVE severity: CVSS, EPSS, KEV (article in French).
- Technical score FIRST’s CVSS standard
- Probability of exploitation FIRST’s EPSS model
- Known, active exploitation CISA’s KEV catalogue
- Asset criticality
- Position in an attack path
Frameworks built into the prioritisation engine: NIST, MITRE ATT&CK, ANSSI, NIS2 , DORA, ISO, PCI-DSS, CRA, among others.
From fix to proof
-
Assign
Each priority vulnerability becomes an assigned ticket.
-
Fix
The action plan guides remediation.
-
Replay
The Beareye Command Center replays the analysis to confirm the fix.
-
Measure
MTTR and compliance with remediation SLAs are tracked over time.
One building block of a CTEM programme
Vulnerability management is the treatment stage of a continuous threat exposure management (CTEM) programme, which adds scoping of the perimeter, offensive validation and measurement of risk reduction. To choose between the two approaches, compare CTEM and vulnerability management .
What share of detected vulnerabilities really needs to be fixed first?
8% of the vulnerabilities identified met all three priority criteria: known exploitability, real exposure and an asset critical to the business. The others are not ignored: they are scheduled. This triage focuses remediation effort on fewer than one vulnerability in ten.
Aggregated, anonymised data: 20 organisations monitored with Beareye over two years and 30 penetration tests carried out by BEAROPS over three years. Vulnerability-asset pairs meeting all three criteria, divided by the total number of pairs assessed.
Sources and references
Frequently asked questions
What is VMDR?
VMDR (vulnerability management, detection and response) refers to managing the vulnerability lifecycle: detect, prioritise, fix and verify. In Beareye, this function is part of the Command Center and draws on the findings of all engines.
How does Beareye prioritise vulnerabilities?
Beareye combines the technical score of the vulnerability, its probability of exploitation, its known exploitation, the criticality of the asset and its place in an attack path. This contextual approach surfaces the vulnerabilities that are genuinely dangerous, not the most numerous.
Does Beareye check that the fix worked?
Yes. After remediation, Beareye replays the analysis to confirm that the vulnerability is no longer present or exploitable. Time to remediate and SLA compliance are measured over time, which builds the evidence for senior management.
How is it different from a simple vulnerability scanner?
A scanner detects and scores. Beareye adds asset context, exploitability validation, ticket assignment, replay and MTTR measurement. The scanner produces a list; Beareye gives you control.
Cut the noise, fix what matters
A demonstration shows how Beareye prioritises your vulnerabilities by real exploitability and tracks remediation through to proof, in your own context.