Skip to main content

01 / Manage vulnerabilities

See beyond severity.
Keep the response moving.

Bring findings and service context together. Review exposure and agency impact, work through evaluations and responses in batches, and keep the records behind your VER reports connected.

Walk through your VDR workflow Explore your Rev5 transition
Boundera/ Acme CloudRev. 5 · Class C
Sample workspace

Vulnerabilities

Finding register · evaluated in your environment

4 findings
Evaluations documented3/4 75%
Private worker subnet; vulnerable path disabled. A patch is still scheduled; this is not a remediation claim. Patch scheduled.
VUL-1042Mitigation recorded

Outdated package · worker image

High
PAIN
N2 · Narrow
Exploitable
No
Internet reachable
No

PAIN = Potential Agency Impact · not scanner severity

Vulnerability SpecialistVUL-1042 · worker image
AI
You: High severity, but what’s our actual exposure?
Answer

Not internet reachable; the vulnerable path is disabled. Mitigation is recorded, but the patch is still scheduled. This is not a closure or risk-acceptance decision.

E1VUL-1042E2Exposure evaluation
Sample answer ready to review.
FocusVUL-1042 · worker image
Ask first

Scripted preview · sample data · no messages leave this page

Your team, with more capacity

Check the context
before the decision.

A severity label alone does not explain the exposure or impact. Keep missing facts visible for your team to resolve.

See beyond severity.

Check exposure and impact before making a risk decision.

Missing context flagged, never guessed.
Vulnerability specialistSelected finding
AI
You: Can this high-severity finding be treated as low risk?

I’ll take a look.

Sample walkthrough paused.
FocusSelected finding
Ask first

Scripted preview · sample data · no messages leave this page

AI proposes. Code checks the source. Your team approves.

Work through the queue

Review in batches.
Keep each decision traceable.

Stage evaluation and response instructions across selected findings while retaining the context behind each record.

  1. Bring the finding and context together

    Keep scanner facts, affected resources, and service context available. Check reachability, exploitability, and potential agency impact before deciding what the finding means.

    Output

    Findings with evaluation context and visible missing information.

  2. Stage the evaluation and response

    Work across selected findings with batch instructions. Review the proposed work and resolve missing context before recording your team’s decisions.

    Output

    Reviewable evaluation and response work linked to the selected findings.

  3. Follow the response through

    Keep the treatment decision, response plan, deadlines, and remediation evidence with the record. A recorded mitigation does not by itself close the finding.

    Output

    Maintained response records and a decision history for reporting.

Try the workflow

Follow one finding
through reporting.

Review a sample evaluation, record a response plan, and inspect the decisions and open work in the resulting record.

Boundera / Acme Cloud
Rev5 · Class C · Sample

One finding.
A connected decision trail.

VULN-1042 / PUBLIC APINeeds evaluation

A finding is the starting point.

Keep the technical facts available when the compliance work begins.

AWS Inspector · sample finding

Vulnerable dependency in a public API

Source severity: High · Resource: public-api

Finding contextPublic API workload

Affected package and resource retained with the source record.

Service contextAgency-facing service

Evaluation considers how the finding could affect the offering.

Scanner severity is one input. Reachability, exploitability, and potential agency impact still need evaluation.

Sources → decisions → response → reportingSample actions stay in this browser.

Illustrative data. Sample actions stay in this browser; the JSON download is a workflow summary, not an official FedRAMP report format.

From maintained records to reporting

Prepare your VER reports
from the work you track.

Keep the current vulnerability record, accepted-risk information, and reporting history connected.

Vulnerability Detail Report
Export the vulnerability details maintained for the reporting period.
Accepted Vulnerability Info
Prepare accepted-vulnerability records with the supporting rationale your team has recorded.
Historical VER Activity
Retain reporting activity for later review alongside the evaluation and response history.

Your team owns the evaluation, response, and external reporting decisions. The examples use illustrative data and do not change real findings.

See the reports alongside your SDR and CPO

Walk through your
own records with us.

Bring your current package or review process. See what carries forward and what your team needs to finish.

Plan your Rev5 transition