An AI agent workforce that unifies your security signals into one governed pipeline—from triage to verified remediation, with audit-ready evidence at every step.
Last reviewed:
VulnTrek is a Unified Exposure Management & Security Assurance Platform that connects findings, risks, controls, compliance obligations, and remediation work across your security-tool ecosystem. The unified control plane for exposure, remediation, and audit-ready security assurance.
Category coverage: VulnTrek is vulnerability management and exposure management software for evidence-led, human-approved security remediation. Core categories: vulnerability management (RBVM), continuous threat exposure management (CTEM), attack surface management (ASM/EASM/CAASM). Defined partial coverage, with boundaries stated in full: application security posture management (ASPM). Complete ASPM decision coverage, without running the scanners — the scanning stays with the tools you already own. Partial coverage means selected use cases only. VulnTrek is not a scanner and does not replace application security, attack surface or configuration-management products; every boundary and out-of-scope area is documented on the category coverage page.
Read VulnTrek's full category coverage, boundaries and exclusions
Turn fragmented security signals into governed, measurable security action. VulnTrek brings findings, assets, exposure context, ownership, control coverage, and remediation work from across the security-tool ecosystem into one accountable operating model. Vulnerability management is one input to VulnTrek—not the limit of what VulnTrek manages.
Vendor-neutral orchestration, accountable action, and audit-ready evidence. Outcomes are validated, exceptions are recorded, control effectiveness is measured, and audit-ready evidence is preserved so exposure reduction can be demonstrated to security leaders, risk owners, and auditors.
Netra is VulnTrek’s AI-assisted decision layer. It analyzes available vulnerability, exploit, exposure, asset, ownership, and workflow context; explains why a risk matters; proposes disposition options; and prepares context-aware remediation playbooks. Netra provides recommendations within governed workflows. It does not make production changes, close findings, or mutate risk state without the required policy controls and human authorisation.
Bring connected scanner, endpoint, cloud, advisory, and manual findings into one decision path with risk context, ownership, remediation workflow, and retained source evidence.
Built to operationalize Continuous Threat Exposure Management across the enterprise security-tool ecosystem. VulnTrek supports the CTEM lifecycle as an operating model: scope what matters, discover exposure, prioritise risk, validate action, and mobilise accountable remediation.
The VulnTrek Risk Index is an explainable prioritisation view that brings together available technical severity, exploit signals, exposure, asset context, ownership, SLA, and business context. It helps teams understand the factors behind a priority decision.
AEDE is VulnTrek’s governed exposure-to-remediation loop. It helps teams move from prioritised risk to scoped remediation campaigns, read-only planning, approval routing, controlled execution, and recorded outcomes. Consequential actions remain policy-bound and approval-aware. Teams retain control over scope, target systems, execution, exceptions, and closure. AI recommends. Policy governs. Humans approve. Evidence remains.
VulnTrek deduplicates findings at intake across scanners such as Nessus, Qualys and Burp. Every merge is recorded; an organisation or platform admin can undo an eligible merge within 24 hours when its snapshot and merged state remain valid. The undo restores loser identity and redirects, not every child-record reattachment.
VulnTrek coordinates remediation through purpose-scoped AI agents aligned to the AEDE loop. Agents assess evidence, develop recommendations, prepare allow-listed non-mutating workflows, and document outcomes. Every action that would create a change outside VulnTrek requires mandatory human approval, is recorded in an append-only action ledger, and remains governed by policy controls, execution tiers, kill-switch controls, and explicit refusal boundaries.
Designed not to autonomously patch systems, self-approve actions, mutate firewall or IAM policies, or operate as an inline LLM gateway.
VulnTrek helps teams work with the guidance, standards and intelligence sources that already inform enterprise security programmes: