Vulnerability lifecycle management

Findings that behave like work

A finding without an owner, a business unit and a date is a row in a spreadsheet. Netras gives every finding all three, applies your SLA policy to it, and shows you the ones that are about to breach rather than the ones that already have.

Book a demo Platform overview

Scanner, XLSX and PDF importSLA policy per severityBusiness-unit scoping

What it does

The whole lifecycle, not just the list

Import, triage, assign, chase, re-test, close, and prove it stayed closed. Each step is a state the finding is actually in, not a label somebody applied by hand.

Import that does not lose anything

Scanner output, XLSX and vendor PDF reports, parsed deterministically. No model guesses at your findings, because a hallucinated severity is worse than no import.

Triage with a reason

Accept, defer or mark a false positive, each with the justification stored. A suppressed finding keeps its history so a later auditor can see who decided and why.

Owners and business units

Scoping means a business owner opens the product and sees their estate. It is enforced on the request path, not hidden in the interface.

SLA policy you set

Days per severity, per environment if you need it. Ageing, burn-down and breach are computed from your policy rather than from a vendor default.

Campaigns

Name a piece of work, scope it once, and chase it to completion across every application it touches. The campaign is the unit people can actually agree to.

Re-test rounds

Round two of a test matches back to round one even when the vendor has renumbered every finding, so a reopened issue is visible as a regression.

The Netras dashboard, showing findings past their SLA date alongside evidence collected automatically

Audit rounds

An audit is an observation event

A finding is not created by a scan: it is first seen in one. Netras records which audit first observed an issue and which later ones still saw it, so a finding that survives three rounds reads as a finding that survived three rounds, and not as three findings.

Round-over-round matching by location and content, not by the vendor's own numbering
Regression detection when a closed finding reappears in a later round
First-seen preserved, so age is real age and not the age of the latest import
Archived rather than deleted, so removing an audit never removes an earlier round's history

Questions people actually ask

Before you book anything

Will it take our existing scanner output?

Yes. Import is deterministic parsing of scanner formats, XLSX and vendor PDF reports. If a report cannot be parsed confidently the rows are staged for you to confirm rather than guessed at.

How is SLA breach calculated?

From your policy: days allowed per severity, counted from when the finding was first seen, not from when it was imported. An import of year-old findings shows them as a year old.

Can a business owner see only their own unit?

Yes, and the scope is enforced server-side on every request. Unit membership and project ownership both grant access, so a project owner outside the unit is not locked out of their own work.