Answers about the Cyber Resilience Act, EU Cybersecurity Act, AI exposure, integrations, ROI, data residency, and VulnTrek risk scoring. The links below point at the related VulnTrek pages — capabilities, integrations, security and contact.
Frequently Asked Questions
How does the platform integrate with our existing security tools?
vendor-specific finding integrations, ticketing/workflow connections and generic signed-webhook/API intake — including Jira, ServiceNow, HackerOne, Bugcrowd, Tenable, Qualys, Rapid7, Wiz, CrowdStrike and OpenVAS/Greenbone — plus a signed webhook for any tool that can send findings over HTTP. Ticketing works in both directions with Jira and Linear: VulnTrek pushes remediation tickets out, and signed webhooks bring status changes back, so a ticket closed in Jira or Linear updates the finding in VulnTrek. GitHub and ServiceNow connections are set up individually during onboarding. A versioned REST API and HMAC-signed webhooks cover everything else. Setup effort depends on the tool, its version and the access available, so each connection is planned and validated with you during onboarding.
How can we measure ROI?
VulnTrek does not publish customer ROI figures. Value is best assessed in a scoped proof of concept against success criteria agreed in advance — for example, how many overlapping findings are collapsed at intake, how quickly findings reach an accountable owner, and whether closure is verified with evidence. Because those measurements come from your own data, you can judge the result directly.
How long does implementation take?
Onboarding is planned with you rather than run on a fixed timetable. It usually starts by connecting one scanner and the CISA KEV and NVD feeds, then adds Jira/ServiceNow sync, notifications, single sign-on and asset-criticality mapping, followed by SLA policies, dashboards, custom risk formulas and scheduled reports. How long each step takes depends on your tools, access and internal approvals.
How is VulnTrek priced?
Three tiers, billed annually in EUR, priced on deduped assets and write seats. Starter starts at €490 / month (5 seats, up to 500 assets, 5 connected sources). Growth starts at €1,900 / month (10 seats, 501–5,000 assets, 15 sources, custom ownership and CTEM preview). Enterprise uses asset-based pricing for 5,000+ assets with unlimited seats and sources, full CTEM and hackability scoring. Viewer seats are always free. Seat add-ons €40/seat/month, source add-ons €25/source/month. Support scope and response targets are documented in the signed order form.
Where is my data stored and processed?
VulnTrek's application data — database, authentication and file storage — is hosted in the EU, in the Frankfurt (eu-central-1) region. Each organisation's data is separated by access rules enforced in the database and encrypted in transit and at rest. The public website is delivered through a global content delivery network, and AI features send the relevant prompt content to the model providers named on our Sub-processors page. Backups are daily database snapshots; we do not currently operate a standby region. NIS2 and BSI C5 control mappings are available, and the full sub-processor list is published on the Sub-processors page.
What is the status of your SOC 2 and ISO 27001 certifications?
VulnTrek is not currently certified to SOC 2 or ISO/IEC 27001, and no audit opinion has been issued. We are preparing for SOC 2 Type I: controls are drafted and being operated, and the auditor engagement letter has not yet been signed. ISO 27001 scoping is underway. An independent external penetration test is planned but has not yet taken place. We do not publish target dates until engagements are signed. Our NIS2 and BSI C5 control mappings are available on request under NDA.
How does AI-powered duplicate detection work?
Every incoming finding is converted into a multi-signal embedding — CVE/CWE identifiers, affected component and version, endpoint or file path, request/response fingerprints, screenshot hashes and reporter prose — then compared against the open and historical backlog. A Lovable AI Gateway model scores semantic similarity, and a deterministic rules layer breaks ties on CVE + asset + scanner. Suspected duplicates are auto-linked with a confidence score and a side-by-side diff; triage owners approve or reject in one click. Every decision is logged. An organisation or platform admin can undo an eligible merge within 24 hours when its snapshot and merged state remain valid; this restores loser identity and redirects, not every child-record reattachment.
Is my vulnerability data secure?
VulnTrek is not yet SOC 2 or ISO 27001 certified; our current preparation status is published in the Trust Center. Vulnerability data is protected with encryption in transit and at rest, organisation-scoped access rules enforced in the database, role-based access control, multi-factor authentication and audit logging. Control mappings are available on request under NDA.
How does CISA KEV compliance automation work?
The platform automatically monitors the CISA Known Exploited Vulnerabilities catalog daily. When a new KEV is added that matches your asset inventory, we immediately create prioritized tickets, notify relevant teams, and track remediation against federal deadlines—all automatically.
Can we customize risk scoring for our business context?
Yes. While we provide CVSS, EPSS, and industry-standard scoring out of the box, you can create custom risk formulas that factor in your crown jewel assets, business criticality, data sensitivity, and regulatory requirements. This ensures vulnerabilities are prioritized based on actual business impact.
What kind of support do you offer?
Support is provided through the in-app help centre and by email, backed by documentation and video tutorials on every plan. Response targets, escalation contacts and any service-level terms are agreed in writing as part of your contract rather than published here.
Does VulnTrek use agentic AI?
Yes. VulnTrek uses a governed, purpose-scoped AI agent workforce to support evidence-led remediation workflows. Agents operate within defined execution tiers and allow-listed actions. Human approval is required for every change leaving the platform, and VulnTrek does not autonomously patch systems, self-approve remediation, mutate firewall or IAM configurations, or function as an inline LLM gateway.
What does the EU Cyber Resilience Act (CRA) require, and how does VulnTrek support it?
The Cyber Resilience Act (Regulation (EU) 2024/2847) obliges manufacturers of products with digital elements to ship without known exploitable vulnerabilities, maintain an SBOM, handle vulnerabilities across the support period, and report actively exploited vulnerabilities and severe incidents to ENISA and the relevant CSIRT within 24 hours of awareness. VulnTrek supports this with PURL-resolved SBOM component inventory, exploitability adjudication against CISA KEV and EPSS to identify known exploitable vulnerabilities before release, coordinated vulnerability disclosure intake through the VDP triage workflow, SLA-timed remediation with verified closure, and an immutable Pramana Ledger evidence trail per finding that shows when awareness started, what was decided and when the fix was proven.
How does VulnTrek help with the EU Cybersecurity Act (CSA) and NIS2 obligations?
The EU Cybersecurity Act (Regulation (EU) 2019/881) establishes ENISA's mandate and the European cybersecurity certification framework, which downstream schemes such as EUCC build on; NIS2 (Directive (EU) 2022/2555) adds risk-management measures and incident reporting for essential and important entities. VulnTrek maps each finding, decision and remediation action to the relevant control and article, so certification and NIS2 audits are answered from live platform evidence — asset inventory, exploitability rationale, treatment decisions, SLA performance and closure verification — instead of hand-assembled spreadsheets.
Is VulnTrek relevant to the EU AI Act, and which obligations does it support?
Yes. The EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers to know which AI systems they operate, classify use cases that fall into the Annex III high-risk areas, run a documented risk-management system for high-risk systems (Art. 9), keep automatic records of system operation over its lifetime (Art. 12), carry out a fundamental rights impact assessment where Art. 27 applies, and maintain post-market monitoring of performance and risk (Art. 72). VulnTrek supports these obligations from the operational side: AI exposure is inventoried as a first-class attack surface class (model endpoints, AI gateways, retrieval and vector stores, agent tool integrations, model supply chain), each AI asset carries its intended use case and Annex III category tag, prompt and retrieval data flows are recorded with the data classes involved, every AI asset carries an owner and exposure grade, AI-assisted verdicts and human approvals are written append-only to the Pramana Ledger as oversight evidence, dated inventory and oversight artefacts export into an Art. 27 assessment file, and continuous re-discovery plus drift and shadow-AI alerting provides post-market monitoring evidence. VulnTrek is not a conformity-assessment body and does not intercept prompt traffic; it produces the technical inventory, classification, risk and monitoring evidence that AI Act documentation and NIS2, DORA, CRA and ISO/IEC 27001:2022 audits draw on.
Does VulnTrek intercept prompt traffic or act as an LLM gateway?
No. VulnTrek operates strictly out-of-band. It discovers and inventories AI systems, records which data classes their prompt, retrieval and training flows touch, grades their exposure, and adjudicates the resulting findings under a human approval gate — producing inventory, classification, decision and monitoring evidence. It does not sit in the inference request path: VulnTrek does not proxy, intercept or inspect live prompts or completions, does not mask, redact or block them at runtime, does not act as an LLM gateway, inline guardrail or model firewall, and does not route inference between cloud and on-premise models. Runtime prompt enforcement is a complementary control layer; VulnTrek governs the exposure and the evidence around AI systems, not the traffic inside them.
How does Attack Surface Management with AI exposure reduce operational risk?
AI exposure is enumerated as a first-class surface class: model endpoints and inference services, AI gateways and APIs, retrieval and vector stores, agent tool integrations, and the AI supply chain of model artefacts and libraries. Every AI asset is deduplicated onto one record, attributed to an owning team and tier, and exposure-graded for internet reachability and data sensitivity. Operationally this removes shadow AI deployments, prevents unauthenticated or over-permissioned inference endpoints from sitting undetected, and sends only semantically validated, exploitable AI-surface findings into remediation with agentic playbooks and an SLA — so engineering time goes to real exposure rather than scanner noise.
How does AI exposure monitoring reduce compliance risk?
Regulators increasingly expect an accurate inventory of AI systems and evidence that their exposure is managed: the EU AI Act requires system-level records and post-market monitoring, CRA requires vulnerability handling for products with digital elements including their AI components, and NIS2 and ISO/IEC 27001:2022 require asset inventory and technical vulnerability management. VulnTrek keeps AI assets, data flows, owners and remediation history in the same ledger as the rest of the estate, so the answer to "which AI systems do you run, what data do they touch, and how do you fix their exposure?" is a query, not a project.
Is VulnTrek only for governance and audit teams?
No. VulnTrek is one all-in-one platform for CISOs, developers, application security, SecOps and compliance teams. Security operations get a validated, deduplicated backlog with ownership and SLAs; developers get fix-level remediation guidance and agentic AI playbooks in their existing workflow; CISOs get the VulnTrek Risk Index for technical and financial exposure; compliance and audit teams get the same evidence mapped to CRA, EU CSA, NIS2, DORA, ISO/IEC 27001:2022 and SOC 2 controls without duplicate reporting.
How does VulnTrek support CERT-In and India's DPDP Act?
India runs the strictest incident clock in force today: the CERT-In Directions of 28 April 2022 require reporting cyber incidents within 6 hours of noticing them, alongside 180-day log retention and a named point of contact — where NIS2 allows 24 hours for an early warning and DORA 24 to 72 hours. A 6-hour submission is only realistic if the trail already exists, so VulnTrek timestamps discovery, triage, ownership, SLA state, verification and closure as they happen and assembles the report from that ledger instead of reconstructing it under deadline. For the Digital Personal Data Protection Act, 2023, mapping stays deliberately coarse: findings on personal-data-bearing assets are treated as a reasonable-safeguards governance signal under Sec. 8(5) and the audit trail supports the breach-intimation duty under Sec. 8(6). RBI-regulated banks and NBFCs can switch on an RBI cyber-security overlay that adds its citations next to CERT-In; it is opt-in and never inferred from region alone.
Which regulations and frameworks does VulnTrek map evidence to?
India: CERT-In Cyber Security Directions (April 2022) and the Digital Personal Data Protection Act, 2023, with an opt-in RBI cyber-security overlay for regulated banks and NBFCs. European Union: Cyber Resilience Act (CRA), EU Cybersecurity Act (CSA), NIS2, DORA, the EU AI Act (Regulation (EU) 2024/1689) and BSI C5. Cross-region: ISO/IEC 27001:2022, SOC 2 and CISA KEV-driven remediation deadlines. One region is active per organisation, sector overlays are opt-in and never inferred, and the region changes only which citations are shown — severity, SLA, status, totals and audit history are identical in every region. Mapping is control- and article-level, so a single remediated finding can contribute evidence toward several obligations at once and each citation traces back to platform evidence. Mappings are an informational aid, not legal advice, an attestation or a certification determination.