Cybersecurity Management › Vulnerability Management

Vulnerability Management

BC-620.40 Level 2 Cross-Industry 104 providers 321 API surfaces 45 rated strong or better

Vulnerability scanning, patching, remediation.

Vulnerability Management (BC-620.40) is a level-2 business capability under Cybersecurity Management in the Cross-Industry model. The catalog holds 321 API surface(s) from 104 provider(s) that can perform some part of it, 45 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Vulnerability Scanning BC-620.40.10

Authenticated and unauthenticated scanning across the estate.

no catalog coverage

Vulnerability Triage and Prioritisation BC-620.40.20

Risk-based prioritisation of vulnerabilities for remediation.

no catalog coverage

Patch and Remediation Management BC-620.40.30

Coordination of patching and remediation across owners.

no catalog coverage

Penetration Testing and Red Teaming BC-620.40.40

Penetration tests, red team exercises, and adversary simulation.

no catalog coverage

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 11 Complete, well-documented, and agent-ready
CloudflareScansSecurity Center InsightsSecurity Center ScansTarget Environments5 APIs80.6SnykFindingsIssuesProjectsTests4 APIs79.1GitHubCode-Scanning1 API79.0JiraSecurity Information1 API75.3OneTrustVulnerabilities1 API71.7FeedOracle TechnologiesSecurity1 API70.1MalwarebytesOS PatchesVulnerability AssessmentVulnerability Management3 APIs69.1JFrogReportsScanning2 APIs68.9Cisco XDRVulnerability1 API68.3Palo Alto NetworksAdvisoriesAttackSurfaceRulesContainersDiscovery and Exposure Management20 APIs68.2TenableAgent ExclusionsAgent GroupsAgentsApplications24 APIs67.6
Strong 34 Solid coverage with minor gaps
OracleapplicationDependencyManagementvulnerabilityScanning2 APIs65.9Recorded Futurerecorded-future-asi-project-apirecorded-future-common-platform-enumeration-apis-v0-api2 APIs64.3RoutebaseSecurity1 API64.3AiriaRedTeamingEvaluation1 API64.0Cisco Catalyst SD-WANMonitoring - Device Configuration Security Advisories1 API63.8MendAlerts - ProductAlerts - ProjectFindings - ProjectFindings - Scan8 APIs63.4SonatypeVulnerability Details1 API63.3Eclipse FoundationCVE1 API62.6GoHarborScanScannerSystemCVEAllowlistscan data export6 APIs62.1DomScanSecurity1 API61.8Red HatErrataManifests2 APIs60.8OpenText CybersecurityDAST Automated ScansDynamic ScansMobile ScansOpen Source Scans7 APIs60.4AnacondaCVEs1 API60.3Cisco Intersighttam1 API60.3ArmorImageVS ExclusionsVS ReportsVulnerability Scanning4 APIs60.0FeedlyCVEsVulnerabilities2 APIs59.6IruVulnerability Management1 API59.6CybelAngelADM Inventory1 API59.5KonduktoProjectsScansVulnerabilities3 APIs59.2Amazon EC2 Image BuilderListImageScanFindingAggregationsListImageScanFindings2 APIs58.8Contrast SecurityVulnerabilities1 API58.6Amazon Web ServicesVulnerabilities1 API58.5IBM WebSphereVulnerabilities1 API58.4Cisco PSIRT openVuln APICurrent EndpointsObsolete EndpointsSunset Endpoints3 APIs57.9XbowAssessmentsFindings2 APIs57.8FortifyApplicationsDAST Automated ScansDynamic ScansIssues12 APIs57.4VeracodeFindingsManual Penetration Testing2 APIs57.3CheckmarxResultsRisk ReportsScans3 APIs57.0Nord SecurityApplications1 API56.9ShodanCPECVEInternetDBOn-Demand Scanning4 APIs56.7Crowd.devAdvisories1 API56.4KnosticScans1 API56.2VulnCheckEndpointsIndices2 APIs55.6Amazon InspectorCodesnippetCoverageEc2deepinspectionconfigurationEc2deepinspectionstatus9 APIs55.0
Developing 29 Usable, with meaningful gaps to close
HuntressExternal Recon1 API54.2ProjectDiscoveryAssetAssetsConfigurationsEnumerations11 APIs53.5SpecterOpsAttack Paths1 API53.2CoreStackAppSecOps1 API53.1GreyNoise IntelligenceCVE1 API52.8Qwiet AiCompoundsFindingsScansautofix4 APIs52.7UpGuardVulnerabilities1 API51.8Snyk ContainerContainer ProjectsIssues2 APIs51.4Pyntapplicationscanscan-business-impact-analysisscan-false-positive-analysis7 APIs51.2SynackAssessment LifecycleAssessmentsCommentsPatch Verifications7 APIs50.6NinjaOneVulnerability Management1 API50.0VantaVulnerabilities1 API48.6AvalixAgent Security Test1 API48.4Root (fka Slim.ai)AVRCore - Discovered Packages V3CveFeedDiscovery10 APIs47.6CloudGuardEcs Image ScanIgnore CvesKubernetes Image AssuranceTenable Account8 APIs47.3PlerionCode securityVulnerabilities2 APIs47.0Red Hat Enterprise Linux 8AdvisoriesCVEsOVAL3 APIs45.6SysdigImage ScanningVulnerabilities2 APIs45.3Red Hat Enterprise LinuxAdvisoriesCVEsOVAL3 APIs44.8BinarlyEscalationFindingScanVulnerability4 APIs44.7Telenor SverigeCVEs1 API44.5CybleHosts1 API43.7SocketFixesdiff-scans2 APIs43.6Forward NetworksVulnerability Analysis1 API43.3StackHawkPerchProfile ScansReportsScan Configuration6 APIs42.6Dome9AwsInspectorFindingsTenable Account2 APIs42.1NucleiAssetScansTemplateVulnerability13 APIs41.7QuaySecurity1 API40.9Stream.SecurityVulnerabilities1 API39.6
Thin 23 Limited public surface area
WallarmVulnerabilities1 API38.9PackagistSecurity1 API37.9AnchoreVulnerabilities1 API37.3StackRoxImageService1 API37.1Rapid7RemediationScanScan ConfigsScan Engine15 APIs36.9OWASP ZAPaccessControlacsrfajaxSpideralert8 APIs36.2Akamai API SecurityCVE Protections lookup1 API36.1NVDCVECVE Change History2 APIs35.4SecuronixVulnerability1 API35.2watchTowrFindings1 API34.7Chaitin Techvulnerability1 API34.5APIClaritylocal-fuzzer1 API34.4CoalitionCve1 API33.3UbuntuCVEsNotices2 APIs32.8PhosphorusDynamic Scans1 API32.5CloudsmithVulnerabilities1 API32.3SynopsysIssuesScans2 APIs32.2Cybersecurity and Infrastructure Security AgencyKEV1 API32.0OpenSSFQueryQuerybatchVulns3 APIs31.7EscapeAsmIssuesProfilesScans4 APIs31.1Aikido SecurityCode RepositoriesContainers2 APIs31.0National Institute of Standards and Technology (NIST)CPECvehistoryCves3 APIs27.5SaasmentMisconfigurations1 API27.5
Emerging 6 Early or largely undocumented
GitHub EnterpriseCode Scanning1 API26.0KubescapeVulnerabilities1 API26.0ARMORegistryVulnerabilities2 APIs25.2Manifest CyberAssetsVulnerabilities2 APIs25.1NeuVectorScanVulnerability2 APIs23.0Endor LabsFindingsScan Results2 APIs20.0
Minimal 1 Almost no public developer surface
Amazon CodeGuru SecurityBatch Get FindingsFindingsScans3 APIs0.0
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Vulnerability Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →