Vulnerabilities and hardening

Each sensor reports the installed packages. They are matched against published vulnerabilities (CVEs) for that operating system and ranked by severity: Critical, High, Medium, Low, and Unscored where no score is published yet.

Start with the critical ones on machines exposed to the internet; Topology shows which those are. Most fixes are a package update, and a kernel fix needs a reboot before it counts.

Every machine is checked against the CIS benchmark for its system, every few hours. The score is the share of checks passed. Each failing check says why it matters, how to fix it, and which framework controls it supports.