Scan coverage — and what isn't scanned
Which assets are being scanned and, more usefully, which are not. Coverage gaps list owned hosts only; disabled and deleted directory computers are left out.
AthonisOne module 04 of 08
Vulnerability
Not another CVE console. The questions leadership actually asks.
A scanner already has a console for individual CVEs. This module answers the questions the console can't: are we scanning everything we should, are we fixing what we find fast enough, and which exposures matter most given who and what they touch.
What it answers
The questions this module exists for.
- 01 Which owned hosts is the scanner not covering — and who decided the ones we excluded?
- 02 What in our estate is not being scanned at all?
- 03 Are we remediating findings within our expected timeframes?
- 04 Which exposures sit on our most sensitive hosts?
- 05 How is our vulnerability posture trending?
What it checks
In detail.
Accepted non-scan-targets, with the decision recorded
Some hosts genuinely should not be scanned. Accepting one removes it from the coverage denominator — so AthonisOne records who accepted it, requires the reason before accepting, and lists every exception on its own page. A coverage figure is only as trustworthy as the exclusions behind it.
Remediation posture
How the organization tracks against the remediation expectations it set — with remediation broken out by module.
Risk in context
Host-level, rule-driven findings and cross-module correlations, tying exposure to the directory and network context around each host.
Typed findings
Each with the evidence behind it, not just a severity label.
Finding Wiki
A built-in explainer on every finding — what it is, why it matters, what to do.
A posture score
Rolled up from the findings and trended over time.
Compliance evidence
Findings mapped to the framework controls they evidence.
How it judges
Where it refuses to over-claim.
A check that guesses produces false findings, and false findings teach a team to ignore the real ones. These are the places this module holds back.
- A host is what the scanner returns now. Hosts the scanner has aged out of its repositories no longer count as scanned or as stale; a machine whose only record is gone shows as not covered.
- One finding per host, however many records the scanner keeps for it — per repository, per address, active scan and compliance audit. Staleness is judged on the host's freshest record.
- It reports host-level rollups, not a stream of individual CVE instances. That is deliberate.
What it reads
Connected to what you already run.
- Tenable.scScan coverage and vulnerability posture per asset, through the Tenable API on read access
What it never does
The boundary, stated plainly.
- Never runs a scan and never triggers one. It reads what your scanner already holds.
Findings from this module evidence the vulnerability-management and technical-controls areas of every activated framework.
Works with
One dataset, so the modules answer each other.
See what Vulnerability would say about your estate.
Licensed on its own, and on the same platform as every other module. We'll show you the answer — and what it would say it couldn't measure.