The four questions CISOs and security leaders ask before choosing an exposure management platform — cost, autonomy, integration and proof — answered with what VulnTrek actually does today, and where its limits are.
Published pricing: Plans and the Cyber Range add-on are listed publicly, so budget conversations start from real numbers rather than a sales quote. Scannerless by design: VulnTrek works on the findings your existing scanners already produce, so there is no new scanner estate to license or run. Duplicates merged at intake: Repeat findings for the same issue on the same asset are merged into one, so teams stop paying in hours for the same ticket twice. Capped AI spend: Each organisation has a monthly AI allowance checked before every AI call, so AI usage cannot run away silently. Limit: VulnTrek does not replace your scanners, and savings depend on how much duplicate and manual triage work you have today.
Autonomous for low-risk tasks: Agents can run unattended only for read-only or reversible work such as enrichment, likely-duplicate grouping and drafting fix plans. Human-approved actions: Tickets, notifications, pull requests, configuration changes and closing a finding always wait for a named person to approve. Nine governed agents: Each agent in the registry has its own level (Assist, Supervised or Autonomous for low-risk work), on/off switch and kill switch; every level change is recorded with a reason. Business owners decide severity: Crown-jewel marking and owner decisions change priority, because only the business knows what a system is worth. Limit: There is no 'fix everything automatically' switch. The Code fix agent opens pull requests only after approval and never merges.
Scanner and report intake: Import from Nessus, Qualys, Burp, SARIF (for example Semgrep or CodeQL), HackerOne, Bugcrowd and CSV into one register. Assets and SBOMs: Bring assets from a ServiceNow CMDB or uploads, and CycloneDX or SPDX SBOMs for software components. Ticketing and owners: Send findings to Jira with the owner, file and line, so developers get the exact place to fix. Threat intelligence: CISA KEV, EPSS and vendor advisories enrich findings so the actively exploited ones rise to the top. Limit: Each integration has setup steps listed on its card; anything not listed there is not claimed as supported.
Evidence trail: Every approval, closure and agent step is written to an append-only, hash-chained log, so tampering is detectable. Closure with evidence: Findings close only when an owner or admin gives a reason plus a link or file; a re-scan confirms code fixes. Explainable priority: P0 to P3 labels come from one scoring model that shows why each finding got its level. Try it first: Request a demo on a sample organisation before connecting any of your own data. Limit: Evidence supports audits; it is not a certification or a guarantee of compliance with any framework.