runZero Vulnerability Management

runZero Vulnerability Management - Overview

AssetsVulnerability Management

runZero approaches vulnerability management as exposure management. Rather than focusing solely on scanning for known software flaws (CVEs), it identifies, prioritizes and helps remediate the full spectrum of exposures across internal and external attack surfaces, misconfigurations, end-of-life systems, missing controls, risky services, and exploitable vulnerabilities that traditional tools often miss or take too long to detect.

The platform's core philosophy is that attackers exploit weaknesses, not scores. A medium-severity vulnerability on a critical, internet facing asset with no endpoint protection is far more dangerous than a critical CVE on an isolated test device. runZero builds deep context around every asset. It's role, connectivity, business impact and risk factors, then correlates multiple signals into stacked risk assessments at the asset level.

This shifts vulnerability management from generating endless lists of CVEs to producing short, actionable, remediation queues focused on what attackers would actually target.

How to position?

Target customer segments

Organizations with large OT/IoT/IoMT environments

Traditional active scanning can destabilize fragile devices. runZero's passive discovery and gentle active scanning safely detect vulnerabilities and misconfigurations in these environments, while its asset context highlights risks scanners miss

Companies facing compliance pressure

runZero maps findings directly to control requirements, providing evidence of continuous assessment and risk-based prioritization. It flags prohibited software and end-of-life assets that violate policy

Merged or rapidly growing organizations

runZero can scan entire RFC1918 address spaces overnight to find unknown subnets and assets, then immediately assess their exposures. This is invalueable during M&A or cloud expansion

Companies moving to NAC and Zero-trust networks

runZero can quickly find all network-connected assets. This gives IT teams a list to work on, helping them to create their zero-trust NAC strategy.

Quick Wins

When demonstrating runZero to new customers, lead with these easy-to-understand, high-impact use cases

1. Instant Zero-Day response When a new vulnerability (eg Palo Alto firewall authentication bypass, VMware ESXi exploit) is announced, runZero's security research team publishes a query. Within 15 minutes, customers receive an alert if they have affected assets, no rescanning required. This turns a days-long process into minutes.

2. Find Unscanned Assets Show a dashboard comparing discovered assets vs scanner coverage. The message is simple: "Here are 200 servers your vulnerability scanner isn't checking". This immediately justifies the investment

3. Exposed Internal Assets Use Inside-Out Attack Surface Management to find internal devices (RDP, SSH, databases) that are unintentionally internet-facing. This is a common breach vector and resonates strongly with executives

4. Certificate and Key Hygiene Identify expired TLS certificates and widely shared SSH host keys, operational issues that cause outages and security risks. runZero maps each certificate to all affected assets, making renewal planning easy.

5. End-of-Life Software Surface assets running Windows Server 2012, old Linux distributions, or legacy IoT firmware. These are unpatchable vulnerabilities that scanners often miss but auditors always ask about

Did you know?

1. While 26477 new CVE's were discovered in 2023, only 507 (2%) were actively exploited
2. From that 2%, 25% were weaponized on Day 1
3. From that 2%, 75% were under active exploit within 19 days
4. The real issues are mostly related to non-CVE related gaps like:
   • Outdated protocols
   • Poor authentication
   • End-of-life software
   • Open database access
   • Default credentials
   • ...
5. Prioritization is the most important thing! A tool that helps you to do that is worth a lot.

Core Features

Multi-Method Vulnerability & Exposure Detection

runZero combines several techniques to build a complete picture of exposures, without requiring credentials or agents on every device:

• Active Unauthenticated Scanning: Proprietary scanning logic sends well-formed IP packets, no aggressive probes that crash fragile OT devices. It fingerprints OS, hardware, software, and services in depth, using a library of nearly 1000 attributes
• Passive Traffic Analysis: Continuously listens to network traffic to discover devices and protocols, ideal for OT/ICS environments where active scanning is prohibited. Passive data is enriched with the same fingerprinting depth as active scans
• API and Cloud Integrations: Pulls asset and vulnerability data from cloud platforms, virtualization systems, and existing security tools, correlating everything into a unified view
• Nuclei Integration: Embedded Nuclei scanner runs targeted vulnerability checks based on observed services, no need to spray credentials or flood the network with tests.

This multi-method approach ensures coverage of managed, unmanaged, cloud, and external assets, including those missed by traditional scanners.

Risk-Based Prioritization

runZero's key innovation is moving from CVE-centric to asset-centric prioritization. Instead of ranking thousands of vulnerabilities, it ranks assets by their stacked risk: the combination of multiple weakness signals

• Known Exploited Vulnerabilities (KEV): Syncs with CISA KEV and VulnCheck catalogs to flag CVEs with active exploitation in the wild
• Exposure context: Is the asset internet-facing? Does it have open RDP/SSH? Is it on a flat network with high-value targets?
• Asset Criticality: Business context: production vs lab, revenue impact, dependency mapping?
• Misconfigurations & Missing Controls: Weak TLS ciphers, SMBv1 enabled, shared SSH keys, no endpoint agent
• End-of-Life Status: Unpatchable OS or firmware versions that scanners often ignore

The result is a short, prioritized list of high-risk assets rather than an overwhelming CVE backlog. Security teams can focus on fixing the 30 assets that matter instead of chasing 3000 alerts

Instant Query-Based Threat Hunting

Because runZero maintains a rich, queryable asset inventory, it can answer threat questions without rescanning:

• When a new zero-day emerges, security researchers publish a quer (eg "Find all VMware Horizon servers with external exposure")
• Customers copy the query and instantly see affected assets
• No waiting for scanner signatures, no network overload - just immediate answers

This is especially powerful for network-discoverable vulnerabilities, where version banners or service fingerprints reveal exposure long before a formal CVE scan is updated

Inside-Out Attack Surface Management (IOASM)

runZero uniquely correlates internal asset fingerprints (TLS certificates, SSH host keys, MAC addresses), with external metadata to detect when internal assets are unintentionally exposed to the internet:

• Detects public IPs hosting internal services (RDP, SSH, databases)
• Flags assets leaking internal network data via external scans
• Reveals shadow IT and misconfigured cloud resources

This "inside-out" view is critical for finding exposures that external ASM tools miss because they lack the internal baseline.

Feature overview

Vulnerability Scanning & Detection

• Nuclei-Powered Scanning: Integrated Nuclei scanner runs targeted checks based on discovered services, avoiding blind scanning and credential exposure
• Passive CVE Detection: Observes version banners and service fingerprints to detect vulnerabilities without active probing, ideal for fragile OT/IoT
• External Vulnerability Sync: Imports scan data from Qualys, Rapid7 and Tenable, enriching it with network context and coverage analysis
• Coverage Gaps Analysis: Compares discovered assets against scanner results to highlight unscanned devices, ensuring no blind spots

Risk Prioritization & Scoring

• Asset Risk Scoring: Combines criticality, exposure, exploitability, and business impact into a single risk rank per asset
• Stacked Risk View: Shows cumulative risk per asset (eg EoL OS + internet exposure + no EDR = high priority)
• Configurable Dashboards: Customizable widgets track trends, new findings, and remediation progress over time
• Top Vulnerabilities per Asset: Reports list up to 20 highest-risk vulnerabilities per asset, sorted by risk rank and severity

Rapid Response & Threat Intelligence

• Curated Zero-Day Queries: Security research team publishes queries for emerging threats; customers receive alerts within 15 minutes if affected
• KEV Integration: Continuously syncs with CISA KEV and VulnCheck to flag actively exploited vulnerabilities
• Automated Threat Hunting: Pre-built queries in a query library for rapid response events; no manual search building required

Certificate & Key Management

• TLS Certificate Tracking: Detects expired or soon-to-expire certificates across all assets, mapping each certificate to affected services
• SSH Host Key Analysis: Identifies duplicate or shared SSH keys that enable lateral movement
• Weak Cipher Detection: Flags TLS services allowing obsolete or insecure ciphers

Compliance & Governance

• Regulatory Mapping: Flags asset violating NDAA Section 889 (banned Chinese hardware) and other compliance mandates
• End-of-Life Detection: Surfaces unsupported OS, firmware and applications, a key audit finding
• Best Practice Enforcement: Identifies misconfigurations like SMBv1, SSL v2/v3, and default SNMP communities
• Evidence Reporting: Provides dashboards and exportable reports demonstrating continuous vulnerability assessment for NIS2, ISO27001

Integration & Automation

• Bidirectional Scanner Sync: Pulls data from Qualys, Rapid7, Tenable; pushes enriched asset context back to these platforms
• ITSM Ticketing: Automatically opens ITSM tickets for critical findings, with asset ownership and risk context attached
• SIEM/XDR Feeds: Streams high-confidence findings to SIEMs and XDRs for correlation with detection alerts
• API-First Architecture: RESTful API enables custom workflows, asset enrichment, and integration with cloud security tools

Passive Discovery for OT/IoT

• Fragile Device Safety: Sends only well-formed packets; limits per-device load; spreads scans across IP ranges to avoid overwhelming sensitive equipment
• Continuous Passive Monitoring: Complements active scans with always-on traffic listening, providing coverage where active scanning is prohibited
• Healthcare & Manufacturing Proven: Regulary deployed in hospitals and industrial settings withoud disruption

Conclusion

runZero redefines vulnerability management by shifting the focus from scanning for CVEs to managing exposures in full context. Its multi-method detection (active, passive, API), deep asset fingerprinting, and stacked risk prioritization deliver what modern organizations need: speed, coverage and clarity

For security teams drowning in scanner data, runZero cuts through the noise with instant zero-day response and prioritized asset lists. For OT/IoT-heavy environments, it provides safe agentless visibility where traditional tools cannot reach. For auditors and executives, it offers compliance evidence and business risk metrics in plain language

The platform's greatest strength is its queryable inventory: the ability to answer "are we exposed?" in minutes, not days. In a threat landscape where very hour counts, that capability is not just a feature, it is a competitive advantage.