Make exposure findings owned and repeatable
Fortra Vulnerability Management is the broader portfolio enquiry for identifying and tracking weaknesses. Start with the asset population and the decisions that findings will support. Candidate vulnerability data needs context, a remediation owner and a way to confirm change; a large report by itself is not an operating vulnerability programme.
Separate infrastructure scanning, application assessment and other specialist activities. They can use different methods, credentials and safety constraints. Define what is in scope, what cannot be assessed and how newly added assets enter the programme. An absent finding should not be treated as evidence of security if the asset was never reached.
Validate scanning and the remediation lifecycle
Confirm the current Fortra component, supported targets and licence model. Agree authenticated access where required, permitted scan windows and exclusions with system owners. Use a bounded pilot containing known assets and review identification quality before expanding coverage.
Acceptance should demonstrate assignment, prioritisation, exception handling and retest after an approved fix. The risk review should consider service criticality and exposure rather than simply sorting every technical score. For UAE multi-site estates, identify network and access constraints that can affect coverage. Handover should include the asset map, scan configuration, evidence limitations and reporting workflow. Continuing scanning, triage and remediation are distinct responsibilities that should be separately itemised.
Evidence to request for this scope
- Reconcile assessed assets with the authoritative inventory and document unreachable exceptions.
- Validate representative findings and the basis for their remediation priority.
- Trace an issue through assignment, approved treatment and a confirming rescan or retest.