Vulnerability Scanning

Fig normalises data from Tenable, Qualys, Rapid7, Nessus, Microsoft Defender, and others. New scanner integrations are added monthly.

Fig overlays exploit intelligence and asset context on top of CVSS scores to prioritise vulnerabilities that are actively being exploited in the wild.

Fig correlates scanner output with asset context, exploit intelligence, and configuration data to reduce false positives. Findings can be marked as accepted risk with documented justification, approval chains, and scheduled review dates.

Yes. Remediation SLAs are configurable per client, asset criticality, and vulnerability severity. Fig tracks SLA compliance and escalates overdue items automatically to the assigned owner and their manager.

No. Fig sits on top of your current scanners and normalises their output into one view. You keep running the scanners you already have, and Fig handles consolidation, prioritisation, and evidence packaging.

Fig manages vulnerabilities through a 9-state lifecycle: Reported, Triaged, Remediation, Remediated, Verified, Disclosed, and Closed. Each state transition is logged with a tamper-evident audit trail. This separates Fig from tools that just show scan results.