Dashboard guide
Findings
A finding is one vulnerability (CVE) in one package on one host, or one hardening issue. The Findings page lists them, highest risk first. Everyone in the environment can view it; fixing needs the operator, admin or owner role.
Buckets
At the top are chips with a count. Click one to filter.
| Bucket | When | Default deadline |
|---|---|---|
| Act now | Score 80 or higher, or known to be exploited in the wild (CISA KEV, or exploitation "active") and the software listens on the network and is not blocked by the host firewall or limited to the internal network | 14 days |
| This week | Score 60 to 79 | 30 days |
| Planned | Score 30 to 59 | 90 days |
| Watch | Score below 30 | none |
| KEV | On the CISA Known Exploited Vulnerabilities list (a filter across the buckets) |
A known exploited finding (KEV or SSVC active) gets a deadline of 7 days, whatever its bucket.
How the score is built: Risk and priority.
Columns
| Column | Meaning |
|---|---|
| Score | 0 to 100, see Risk and priority. |
| CVE | The vulnerability. A red KEV badge means it is on the CISA KEV list (the tooltip shows the date it was added). |
| Package | The affected package or program. |
| Installed → fixed | The installed version and the first version that fixes it. |
| Host | The host. |
| Exploitability | The strongest exploitation signal: KEV, exploited (SSVC), EPSS ≥ 95%, EPSS ≥ 80%, urgent briefing, NCSC high, public PoC. |
| Exposure (L×R) | How exposed the software is: L (is it used, does it listen) × R (who can reach it). See Exposure. |
| Due | The deadline from the bucket. |
| Status | See below. |
Filters
- Search: CVE, package or host.
- Status: the default is Active (open, in remediation, mitigated, unknown). Also All, Open, In remediation, Mitigated, Accepted (exception), Unknown, Fixed, Fixed restart pending, Not affected.
- Distro, and Ecosystem / image (language packages and container images).
- CVE + config / CVE only / Config (hardening) only.
- Devices, when you have network devices without an agent.
- Order: Highest risk first or Newest first.
Statuses
| Status | Meaning |
|---|---|
| Open | Affected, not yet fixed. |
| In remediation | A plan for it exists. |
| Mitigated | A temporary fix is active (for example a firewall restriction); the vulnerable version is still installed. |
| Accepted (exception) | An admin accepted the risk, with an owner, a reason and an expiry date. When the exception expires, the finding opens again. |
| Unknown | SEK Systems cannot decide, for example for software outside the package manager without a reliable version. |
| Fixed | The fixed version is installed and in use. |
| Fixed restart pending | The fix is installed, but a restart is needed before it counts (Windows updates). |
| Not affected | The source for the operating system states that this version is not affected. |
Per finding or per CVE
Switch the view with Per finding / Per CVE.
- Per finding: one row per CVE per package per host. Rows load in pages of 100 (Load more).
- Per CVE: one row per CVE, with the highest score, the number of packages and hosts, how many can be fixed automatically, and a Fix N button that fixes it on all those hosts.
Export: CSV or JSON of the current selection.
The finding detail
Click a finding to open it:
- Fix: the automatic fix (for example Distro package upgrade) and a Fix button. If there is no automatic fix, the panel says why and gives the manual steps.
- Why <score>?: how the score was calculated, factor by factor.
- Evidence: where the facts come from (the source advisories, the version comparison, the exposure).
- Temporary fixes: mitigations from the catalogue, for when a real fix is not possible yet.
- Same CVE on N other host(s), with Fix on all N hosts.
- Related plans.
Fix never changes anything right away: it creates a plan that first runs a dry run and then waits for approval. You choose the maintenance window and the rollback.
Bulk actions
Tick rows, or Select all N findings that match the filter. Then:
- Fix selected (operator, admin, owner);
- Accept risk… (admin, owner; at most 500 findings): an owner of the risk, a reason (3 to 1000 characters) and an expiry date (at most one year);
- Clear.
Bulk fix
Fix selected opens a preview before anything is created:
- "N fixable automatically in N plan(s) on N host(s)", per route: distro package upgrade, Windows update, Windows application, temporary mitigation, service restart, host reboot, update via CustomBuild.
- Bundling: one plan per host, or one plan per host and package.
- Windows: use the .msu package instead of Windows Update; allow a restart.
- Rollback: automatic where the agent kept the previous state, or manual.
- Not in a plan (N): the findings that are left out, grouped by reason.
- When: now (after approval) or a named maintenance window.
- Create N plans. Each plan starts its dry run and waits for approval.
Afterwards an approver can approve the whole set at once with Approve all (N) under Approvals. You cannot approve your own plans.
If the findings change between the preview and Create (a new report, another plan), the dialog warns "The selection changed" and shows the updated list.