Technical assessment, regulatory frameworks and business value: articles to read and share with your teams.
18 articles
Software can run perfectly while reaching the end of support. Turn vendor deadlines into migration decisions, budgets and tracked actions.
IT leaders, application owners and procurementRead article : Software end of life: stay in control before support endsDisrupted services, exposed data and recovery work: two documented cases show why an alert needs assigned, verified actions.
Business leaders, IT leaders and security teamsRead article : WannaCry and Equifax: when a missed patch becomes a business crisisThe October 2026 PHP alerts show the value of an actionable inventory: knowing where PHP runs, which products embed it and which fixes still need verification.
IT leaders, security teams and operations ownersRead article : PHP2Shell: identify the installations that need action across your estateServers, applications, containers and third-party products: connect components to their deployed occurrences so a relevant alert leads directly to an action list.
IT leaders, security teams and software estate ownersRead article : Critical vulnerability: do you know where the component is across your estate?Connect sources, assets and decisions to provide tracking that operations, ICT risk and compliance teams can use.
Banking and financeRead article : Banking: connect vulnerability management to DORA requirementsAn SBOM becomes useful when it stays linked to distributed versions, their users and treatment decisions throughout maintenance.
Software vendorsRead article : Software vendors: prepare product and version tracking for the CRATrack hardware variants, firmware and dependencies to prepare maintenance campaigns that actually apply.
Industry and connected devicesRead article : Industrial products and connected devices: plan for vulnerabilities across long lifecyclesMove from an alert to an assigned, dated decision while distinguishing EU rules, French transposition and operational practices.
Organisations within NIS2 scopeRead article : NIS2: make vulnerability treatment demonstrableAssess the software actually in use, prepare supplier validation and keep temporary decisions visible.
HealthcareRead article : Healthcare: prioritise fixes while maintaining service continuityComplement integration, managed IT or development services with ongoing assessment and clear roles between provider, client and vulnerability specialist.
IT and managed service providersRead article : IT providers: add recurring vulnerability management to existing servicesMake tool results actionable: verify affected versions, set priorities and assign actions through to verification.
CIOs, CISOs and operationsRead article : Why a scan is not enough to manage vulnerabilitiesThe label “overall” is not enough to understand a score. Retrieve the CVSS version, vector, source and contextual assumptions, then distinguish business priority.
Analysts and vulnerability managersRead article : CVSS “overall”: from the base score to context-based assessmentA demonstration link, observed exploitation and a statistical forecast establish different things. A dated assessment supports a decision suited to the affected system.
Vulnerability assessment and managementRead article : Public exploits, KEV and EPSS: what report links do not always tell youIncorrect matches, unaffected components, less exposed vulnerabilities and incomplete cases require different decisions. A useful exclusion retains its evidence and boundaries.
Vulnerability and operations teamsRead article : False positives: reduce noise without hiding unknownsMultiple subpackages and systems may produce repeated rows without representing separate vulnerabilities. Consolidation must preserve affected instances and evidence.
Linux estates and industrial environmentsRead article : RPM subpackages: consolidate duplicates without losing affected systemsAn older upstream version may include security fixes backported by a distribution. The conclusion depends on the exact package, its provenance and the applicable advisory, not appearances.
Linux, security and operations teamsRead article : Backporting: can an older version already be fixed?An SBOM describes an inventory; vulnerability knowledge keeps evolving. Tracking must retain versions still in use, with or without a pipeline connection.
Software vendors, industry and DevSecOpsRead article : SBOMs and deployed versions: keep monitoring after releaseWhich costs should you compare before outsourcing vulnerability management? A method based on current effort, retained work and the quote, with a worked example.
Leadership, CIOs, CISOs and procurementRead article : Managed vulnerability services: assessing the business value