Cybersecurity Management › Vulnerability Management

Vulnerability Management

BC-620.40 Level 2 Cross-Industry 84 providers 256 API surfaces 32 rated strong or better

Vulnerability scanning, patching, remediation.

Vulnerability Management (BC-620.40) is a level-2 business capability under Cybersecurity Management in the Cross-Industry model. The catalog holds 256 API surface(s) from 84 provider(s) that can perform some part of it, 32 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Vulnerability Scanning BC-620.40.10

Authenticated and unauthenticated scanning across the estate.

no catalog coverage

Vulnerability Triage and Prioritisation BC-620.40.20

Risk-based prioritisation of vulnerabilities for remediation.

no catalog coverage

Patch and Remediation Management BC-620.40.30

Coordination of patching and remediation across owners.

no catalog coverage

Penetration Testing and Red Teaming BC-620.40.40

Penetration tests, red team exercises, and adversary simulation.

no catalog coverage

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 8 Complete, well-documented, and agent-ready
SnykFindingsIssuesProjectsTests4 APIs80.6GitHubCode-Scanning1 API80.3Palo Alto NetworksContainersDiscovery and Exposure ManagementErrorsHosts15 APIs76.9JiraSecurity Information1 API76.3OneTrustVulnerabilities1 API72.7JFrogReportsScanning2 APIs71.6Red HatErrataManifests2 APIs70.6TenableAgent ExclusionsAgent GroupsAgentsApplications24 APIs67.5
Strong 24 Solid coverage with minor gaps
OracleapplicationDependencyManagementvulnerabilityScanning2 APIs66.0Cisco XDRVulnerability1 API65.6SonatypeVulnerability Details1 API64.8ShodanCPECVEInternetDBOn-Demand Scanning4 APIs64.4RoutebaseSecurity1 API64.3Eclipse FoundationCVE1 API63.6MendAlerts - ProductAlerts - ProjectFindings - ProjectFindings - Scan8 APIs63.4Cisco Catalyst SD-WANMonitoring - Device Configuration Security Advisories1 API63.2DomScanSecurity1 API61.5OpenText CybersecurityDAST Automated ScansDynamic ScansMobile ScansOpen Source Scans7 APIs60.3Amazon EC2 Image BuilderListImageScanFindingAggregationsListImageScanFindings2 APIs59.7Cisco Intersighttam1 API59.7Amazon Web ServicesVulnerabilities1 API59.6ArmorImageVS ExclusionsVS ReportsVulnerability Scanning4 APIs59.4MalwarebytesOS PatchesVulnerability AssessmentVulnerability Management3 APIs59.0CybelAngelADM Inventory1 API58.9FortifyApplicationsDAST Automated ScansDynamic ScansIssues12 APIs58.9VeracodeFindingsManual Penetration Testing2 APIs58.8CheckmarxResultsRisk ReportsScans3 APIs58.5Contrast SecurityVulnerabilities1 API58.5IBM WebSphereVulnerabilities1 API58.0Cisco PSIRT openVuln APICurrent EndpointsObsolete EndpointsSunset Endpoints3 APIs57.8XbowAssessmentsFindings2 APIs57.5VulnCheckEndpointsIndices2 APIs55.5
Developing 32 Usable, with meaningful gaps to close
Crowd.devAdvisories1 API54.2HuntressExternal Recon1 API54.1AnacondaCVEs1 API53.9Red Hat Enterprise Linux 8AdvisoriesCVEsOVAL3 APIs53.7ProjectDiscoveryAssetAssetsConfigurationsEnumerations11 APIs53.4SpecterOpsAttack Paths1 API53.1Pyntapplicationscanscan-business-impact-analysisscan-false-positive-analysis7 APIs52.7CoreStackAppSecOps1 API52.5CloudGuardEcs Image ScanIgnore CvesKubernetes Image AssuranceTenable Account8 APIs51.9UpGuardVulnerabilities1 API51.7Snyk ContainerContainer ProjectsIssues2 APIs51.6Microsoft DefenderVulnerabilities1 API51.4NinjaOneVulnerability Management1 API49.9VantaVulnerabilities1 API48.8KnosticScans1 API47.7Root (fka Slim.ai)AVRCore - Discovered Packages V3CveFeedDiscovery10 APIs47.6PlerionCode securityVulnerabilities2 APIs47.0SysdigImage ScanningVulnerabilities2 APIs46.8CyCognitoIssues1 API46.5CoalitionCve1 API45.9Red Hat Enterprise LinuxAdvisoriesCVEsOVAL3 APIs44.7CybleHosts1 API43.6SocketFixesdiff-scans2 APIs43.6PackagistSecurity1 API43.5Forward NetworksVulnerability Analysis1 API43.2StackHawkPerchProfile ScansReportsScan Configuration6 APIs42.6QuaySecurity1 API42.4CloudsmithVulnerabilities1 API42.1NucleiAssetScansTemplateVulnerability13 APIs41.8Rapid7RemediationScanScan ConfigsScan Engine15 APIs41.0WallarmVulnerabilities1 API40.1Stream.SecurityVulnerabilities1 API39.5
Thin 18 Limited public surface area
AnchoreVulnerabilities1 API38.8StackRoxImageService1 API38.4OWASP ZAPaccessControlacsrfajaxSpideralert8 APIs37.6Akamai API SecurityCVE Protections lookup1 API37.0Cybersecurity and Infrastructure Security AgencyKEV1 API37.0NVDCVECVE Change History2 APIs36.9APIClaritylocal-fuzzer1 API35.9Aikido SecurityCode RepositoriesContainers2 APIs35.7SecuronixVulnerability1 API35.2watchTowrFindings1 API34.7ARMORegistryVulnerabilities2 APIs34.4UbuntuCVEsNotices2 APIs34.3Chaitin Techvulnerability1 API33.9OpenSSFQueryQuerybatchVulns3 APIs33.2PhosphorusDynamic Scans1 API32.5National Institute of Standards and Technology (NIST)CPECvehistoryCves3 APIs29.1SaasmentMisconfigurations1 API29.0Manifest CyberAssetsVulnerabilities2 APIs26.6
Emerging 1 Early or largely undocumented
GitHub EnterpriseCode Scanning1 API25.9
Minimal 1 Almost no public developer surface
Amazon CodeGuru SecurityBatch Get FindingsFindingsScans3 APIs0.0
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Vulnerability Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →