What advice do you have for others considering Unified Vulnerability Management?

For a review, I can provide solutions such as Unified Vulnerability Management, Fortigate, Palo Alto firewall, and based on Gartner, I can see that Forescout is also a notable mention. We do use Unified Vulnerability Management. We have used the remediation workflow tools, but we do not fully trust auto-remediation. First, we manually validate whether it is truly a vulnerability or just a false positive alert because sometimes the version indicates a vulnerability, yet there is an available patch for that version. In those cases, we can exclude it manually, so there is no necessity to upgrade certain applications or servers. These false positive vulnerability logs do arise, and we manually filter those before applying changes to avoid potential outages. For instance, this week we focus on critical vulnerabilities, while in the next fifteen days, we will address high vulnerabilities, then move on to medium and low vulnerabilities, which we will prioritize only after more than ninety days. The integration capabilities notably influence our security strategy, as we have it integrated with Microsoft Defender, a scanner that provides critical input. We also utilize a DLP solution and a CASB solution, using ChatGPT and Copilot, with the current integration being mainly with Windows Defender. Risk-based prioritization is vital for resource allocation; for instance, we treat a CVE of ten as critical, and anything from nine point eight down to eight is considered critical. Between eight and seven is high, while below that becomes medium and low. Vulnerabilities rated six or seven are not acted upon urgently, while we respond immediately to vulnerabilities rated at ten and nine, aiming to fix them within the next fifteen days. During our quarterly scans, if we find three or four vulnerabilities across twenty to twenty-four different assets, we allocate tasks to the respective owners, providing them with the remediation steps and necessary patch details for formal change requests. Regarding the pricing for Unified Vulnerability Management, it is definitely not cheap; when compared to Qualys, it is more reasonable. It ranks high among the best software available, nearly matching the price of the Gartner number one product, which is Qualys. Rapid7 is also present, and it is lesser in cost than Unified Vulnerability Management. We have deployed Unified Vulnerability Management in both cloud and on-premises environments. I have been working with Unified Vulnerability Management products for a total of ten years, and specifically, we have been using the Unified Vulnerability Management scanning product for about four years. We initially checked it in two thousand nineteen and purchased it for five years back then, marking our experience with the product from its first stage. My overall rating for this product is nine out of ten.

I have not gone any further than initial awareness regarding Unified Vulnerability Management. I must admit that I did not know they even had an on-premises version. I have no idea if there were any challenges or complexities with the implementation of Unified Vulnerability Management because I have not deployed it. I suspect that Unified Vulnerability Management can generate customizable reports, but since I have not implemented it, I do not know. From my perspective, I use an antivirus solution and a vulnerability management solution. I also have a CMDB, so I already have those. Unified Vulnerability Management could potentially be my CMDB, but I do not know. My understanding is that Unified Vulnerability Management integrates with a number of known vendors that are in the marketplace, popular and common vendors. Therefore, I am guessing that the integration will work, but not having deployed it, I do not know. I cannot rate Unified Vulnerability Management in general from one to ten because I have not implemented the product. Conceptually, I think Unified Vulnerability Management is a great idea, but I do not know if it delivers. I can only tell the marketing information and not the real-life information. My overall review rating for Unified Vulnerability Management is five.

We do use automated scanning, and it will generate a report if any of our organization's assets have some unauthorized software that is non-compliant. Based on the report, we will work on understanding why it is non-compliant and what the reason is for its installation on end user assets, and we will mitigate that. I have not yet used Unified Vulnerability Management's remediation workflow tools, but we are working on it right now as that project is ongoing. About pricing, it is higher compared to others because Unified Vulnerability Management is demanding and more secure than other products since it does not give actual information of the customer, so it is a bit expensive. Organizations should choose to work on the pricing. I rate this solution an 8 out of 10.

We use a private cloud, though I am not certain which vendor it was purchased from and need to verify. I have not used Unified Vulnerability Management's remediation workflow tools. My overall review rating for Unified Vulnerability Management is eight.

For remediation, we do it manually, which is handled by another team. We have not used the remediation workflow tools in Unified Vulnerability Management. The integration capabilities of Unified Vulnerability Management impact our overall IT security strategy positively. It integrates seamlessly with other systems and applications using APIs, and we do not have issues with integration, even with tools to generate tickets and reporting. Risk-based prioritization is important for our resource allocation. When you refer to critical and non-critical vulnerabilities, we know what to focus on and what to tackle at any point in time. With risk-based prioritization in Unified Vulnerability Management, it makes attention-driven decisions possible. We eliminate critical vulnerabilities as soon as possible using an agile process. Other vulnerabilities are worked on based on availability, so critical ones come first, then low and medium risks follow. It is really important. I would rate this review at seven out of ten points.