VulnTrek connects vendor advisories, mapped industrial devices and imported scan findings into an organisation-scoped OT risk workflow, with explainable scores and evidence-backed, human-confirmed closure.
Maintain an OT device inventory with names, IP addresses and asset tags through Device Mapping. The shared asset register accepts CMDB connections and inventory uploads; configured ServiceNow CMDB connections support scheduled updates. Device Mapping fills missing details without overwriting authoritative CMDB values. Correlation depends on the identifiers and inventory your organisation supplies—it is not a promise to discover every device on a factory network.
The OT pipeline brings together public CISA ICS and configured vendor advisory sources. Advisory Impact relates advisory context to mapped devices and linked risk cases. An advisory's presence does not prove that a device is affected. Imported findings contribute to an OT case score only when both the CVE and the device identity match within the same organisation. A matching CVE on another device is related intelligence, not evidence for that case.
OT risk cases combine advisory and available OT context with matching findings. The OT Risk Dashboard ranks cases, highlights known-exploited and past-due work, and opens individual scorecards with a score breakdown and linked evidence. Scores depend on available inputs; missing device identifiers or missing findings limit correlation. Advisory-level views can show same-CVE findings across devices, while case-level scores require the device match.
Track risk cases, deadlines and treatment planning without treating an AI suggestion as permission to change industrial equipment. Owners or organisation administrators confirm closure with a reason and an HTTPS evidence link or an organisation-scoped file. Status changes and closure evidence are recorded in append-only history. Same-device, same-advisory repeat cases can be merged with recorded history and reasoned administrator undo. Safety decisions and approved change windows remain with your authorised operators.
VulnTrek is the exposure-management layer above imported findings and advisory sources, not an active OT network scanner. It does not autonomously patch PLCs or prove device impact from a CVE alone. Feed availability depends on source access and configuration; sources requiring credentials must be connected before they deliver advisories. Compliance mappings are presentation-only and do not certify your organisation.
This public page describes the product only. Your device inventory, findings, risk scores, evidence and reports are not displayed here. Operational workspaces require sign-in, organisation membership and the appropriate licence. A platform administrator assigns IT only, OT only or both; an OT-only customer does not need an IT licence. Tenant records remain scoped to their own organisation.
Public CISA ICS advisories and configured vendor feeds such as Siemens, ABB and Schneider Electric arrive in one advisory list. Advisory Impact shows which of your mapped devices each advisory may concern, so engineers review the relevant equipment first instead of reading every bulletin.
Paste or upload a supported scan export. Findings that carry a CVE and a device identifier—asset ID, name, IP address or asset tag—are matched to devices in your inventory and contribute to that device's OT risk case score. Repeat findings on the same device are merged rather than counted twice.
Owners or organisation administrators close a risk case with a reason and evidence: an HTTPS link or an organisation-scoped file. Every status change is kept in an append-only history, giving reviewers a traceable record of who decided what and when.
Each organisation is licensed for IT only, OT only, or IT and OT together. An OT-only customer does not need an IT licence. Findings are stored once per organisation; the licence controls which workspaces can see them, and an upgrade restores access without re-importing data.
OT pricing is quote-based and depends on the size of your device inventory, the advisory sources you need and whether you combine OT with IT. Any price, term or billing schedule is confirmed in a written quote before purchase. See the main pricing page for platform tiers, or request a demo to scope an OT quote.
For an OT proof of concept, provide an authorised, sanitised device inventory and a supported scan export with device identifiers and CVEs where available. Agree the advisory sources and review whether findings match the intended devices before interpreting the scores. Do not send passwords, private keys or operational secrets in an enquiry. A demonstration is a chance to validate your own data and workflow, not a substitute for an industrial safety assessment.