> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Management Overview

> Overview of vulnerability management in Iru Endpoint. Detect CVEs across your device fleet, prioritize by severity, and track remediation progress.

<Callout icon="list-check" color="#71118C" iconType="regular">This guide applies to Mac computers and Windows devices</Callout>

### About Vulnerability Management

Iru Endpoint's Vulnerability Management feature scans your entire fleet for known Common Vulnerabilities and Exposures (CVEs) based on data from the [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln), providing a clear, organized way to monitor and respond to vulnerabilities across your fleet. By using the different views (**Vulnerability**, **Application**, and **Devices**), you can quickly assess which threats need immediate attention and act accordingly.

### How It Works

Vulnerability Management continuously scans your Mac fleet for known security vulnerabilities by comparing installed applications against the National Vulnerability Database. The system provides multiple views to help you understand and prioritize threats, track remediation progress, and manage risk acceptance across your environment.

Once you've enabled Vulnerability Management, it automatically begins scanning your devices every 15 minutes for application inventory updates. The system then matches these applications against the CVE database hourly to identify any known vulnerabilities. Our Security Research team proactively enriches CVE records missing pertinent data for accurate and timely matches. You can view results through three main interfaces: the Vulnerabilities view for threat-focused analysis, the Application view for software-specific insights, and the Devices view for device-level impact assessment.

### Vulnerability Management Capabilities

#### Viewing CVEs

Vulnerability Management identifies any known Common Vulnerabilities and Exposures (**CVEs**) within your fleet, leveraging information from the National Vulnerability Database (NVD). From the **Vulnerabilities** page in the Iru Endpoint Web App, you can view all relevant CVEs for specific applications.

#### Automated Remediation (macOS)

For macOS, the [Vulnerability Response Library Item](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item) lets you enforce updates for known vulnerable applications using Iru Auto Apps based on CVE severity, triggering automatic remediation on devices without manual intervention.

#### Risk Acceptance

Not every CVE poses the same level of threat. Some may be critical and require immediate attention, while others might be less urgent or not relevant to your environment. Please see our [Accepting CVE Risks](/en/endpoint/vulnerability-management/accepting-cve-risks) article for more information about how to accept CVE risks.

**Key capabilities include:**

* **Real-time scanning** of your entire Mac fleet for known vulnerabilities
* **Multiple view options** to analyze threats from different perspectives
* **Severity-based prioritization** using Common Vulnerability Scoring System (CVSS) and Known Exploited Vulnerabilities (KEV) scoring systems
* **Remediation tracking** to monitor your progress in addressing vulnerabilities
* **Automatic remediation** (macOS only) of known vulnerable applications based on CVE severity using Auto Apps updates
* **Risk acceptance** for vulnerabilities that don't require immediate action

### Vulnerabilities View

The **Vulnerabilities View** provides a complete list of all detected CVEs across your fleet. You can search for specific vulnerabilities by:

* **Vulnerability ID** - Find specific CVE identifiers
* **Vulnerable software** - Filter by affected applications
* **Severity** - Sort by threat level
* **First detected date** - Track when vulnerabilities were discovered
* **Filter by application, OS or platform** - Focus on specific software versions

These filters help you prioritize what needs attention first based on the severity and timing of the vulnerabilities.

### Remediation Filtering

When all vulnerable software and devices impacted by a CVE are patched, the CVE will have a Remediated status.

<Steps>
  <Step title="Filter for Remediated CVEs">
    Use the **Status** filter and select **Remediated**.
  </Step>

  <Step title="View Remediated Results">
    The list will be filtered to display only CVEs for which the CVE was fully remediated.
  </Step>
</Steps>

### CVE Information

When you select a CVE, a detailed drawer will appear, giving you an in-depth look at:

* **Vulnerability description** - Detailed explanation of the security issue
* **Severity level** - CVSS score and threat rating
* **Known exploit status** - Whether it has been exploited in the wild
* **EPSS score** - Probability of being exploited in the next 30 days
* **Age** - How long the CVE has been present in your environment
* **Recommendation** - Guidance for addressing the vulnerability
* **Timeline** - Key dates such as published, first detected, last detected, and modified
* **Official CVE reports** - Links to authoritative sources for more information

This information helps you understand the scope of the threat and its potential impact on your devices.

The drawer also includes tabs for **Devices**, **Vulnerable software**, **Accept Risk**, and **Timeline**.

**Vulnerable Software Tab**

The **Vulnerable software** tab allows you to view all the application, OS, and platform versions affected by a particular vulnerability.

**Devices Tab**

Use the **Devices** tab to view devices affected by the vulnerability. For each device, you can see:

* **Device name**
* **Serial number**
* **Tags**
* **Software** - The vulnerable application and version installed on the device
* **Detection date** - When the vulnerability was detected on the device
* **Path** - The install path of the vulnerable application

### CVSS Score

The Common Vulnerability Scoring System (CVSS) is a method for calculating a qualitative measure of severity. Iru Endpoint Vulnerability Management uses the CVSS score to prioritize vulnerabilities and measure the severity of each vulnerability.

The National Institute of Standards and Technology (NIST) maintains the [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln-metrics/cvss), which provides CVSS enrichment for all published CVE records.

### KEV Score

The Cybersecurity Infrastructure Security Agency (CISA) maintains the authoritative source of vulnerabilities that have been exploited in the wild. Iru Endpoint Vulnerability Management uses the [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) to prioritize vulnerabilities.

### Vulnerable Software View

In the **Vulnerable Software** view, you can see all the software affected by a particular CVE. This allows you to focus your remediation efforts on the software that's most at risk.

#### Report Inaccuracy

<Steps>
  <Step title="Start the Report">
    If there are any issues with a detected CVE, click the **Report Inaccuracy** button.
  </Step>

  <Step title="Select Issue Type">
    Select an issue from the drop-down menu.
  </Step>

  <Step title="Add Description">
    Optionally, enter a **description** of the issue.
  </Step>

  <Step title="Submit Report">
    Click the **Report** button to complete the report.
  </Step>
</Steps>

### Application and OS Coverage

<Tabs>
  <Tab title="macOS" icon="apple" iconType="brands">
    Vulnerability Management scans the following directories for macOS Applications and all supported macOS versions (.app files only):

    * `/Applications`
    * `/Library`
    * `/Users`

    In addition, Vulnerability Management scans the entire disk for vulnerable Homebrew packages.
  </Tab>

  <Tab title="Windows" icon="microsoft" iconType="brands">
    Vulnerability Management scans the following across the system and user registry, Windows applications, and Windows 11 (24H2 or 25H2) operating systems:

    * `HKEY_LOCAL_MACHINE`
    * `HKEY_USERS`
  </Tab>
</Tabs>

### Update Frequency

| Component                             | Frequency        |
| ------------------------------------- | ---------------- |
| **Device App Inventory and Packages** | Every 15 minutes |
| **App Vulnerability Matching**        | Hourly           |
| **Vulnerability CVE Database**        | Hourly           |

### Devices View

The **Devices View** shows you which devices are impacted by the CVE. You can filter this view by **Blueprint**, which makes it easier to pinpoint affected devices within specific configurations or groups.

### Considerations

<AccordionGroup>
  <Accordion title="Vulnerability data sources" icon="database">
    Iru Endpoint uses third-party vulnerability feeds and first-party research to identify CVEs across your fleet. First-party research fills gaps in public databases and enriches CVE data used for matching.

    **Third-party sources:**

    * CVE data from MITRE and the [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln)
    * Vendor security advisories from Apple, Microsoft, and other vendors
    * The [CISA Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), which identifies vulnerabilities exploited in the wild
    * Google Threat Intelligence for additional prioritization signals

    **First-party research:**

    * Iru's Security Research team discovers vulnerabilities, coordinates disclosure with vendors, and enriches CVE records that lack the data needed for accurate matching
    * The team also investigates malware and other threats that may not yet appear in public vulnerability databases
  </Accordion>

  <Accordion title="Scanning scope" icon="magnifying-glass">
    * **macOS**
      * **Applications:** Scans the specified directories for `.app` files. Third-party applications installed outside those directories won't be detected.
      * **Homebrew packages:** Scans the entire disk for vulnerable Homebrew packages.
    * **Windows**
      * **Registry and applications:** Vulnerability Management scans the system and user registry and Windows applications. For supported versions and locations, see [Application and OS Coverage](#application-and-os-coverage).
    * System frameworks and libraries are not included in vulnerability scanning.
  </Accordion>

  <Accordion title="Update timing" icon="clock">
    * New vulnerabilities may not appear immediately after database updates
    * Allow up to an hour for new CVEs to be reflected in your fleet scan results
    * Device App Inventory and Packages updates every 15 minutes, but vulnerability matching occurs hourly
  </Accordion>

  <Accordion title="Remediation tracking" icon="list-check">
    * CVEs are marked as "Remediated" only when all affected software and devices are patched
    * Partial remediation won't change the overall CVE status
    * Use the Devices view to track individual device remediation progress
  </Accordion>
</AccordionGroup>