Vulnerability assessment of running systems
Ivy Insight finds the weak spots in the systems you already run: what is open to the internet, websites and APIs (Application programming interface. The interface one program uses to talk to another.), servers, cloud accounts and databases. It can run fully inside your network.
For security teams, and for the engineers who fix what it finds. Run it as often as you like, by hand or on a schedule (daily or weekly), before and after a release.
11 engines
Each engine checks one area. All of them write findings (One problem a check reports, with its evidence and how to fix it.) the same way, and each one records what it could not check. A full assessment runs every engine that applies to a system in one scan.
Subdomains (A name under your main domain, such as shop.example.com.), certificates, dangling records (A DNS name that still points to a service that no longer exists, which someone else could claim.), and the services published to the internet.
Open ports, the services behind them, and the ones that should never be reachable from a network.
Response headers, cookies, exposed files, allowed methods and cross origin policy (Browser rules on which other sites may read a page.) on a live site.
Authentication, and whether one identity can read or change what belongs to another.
Data stores, queues and caches reachable without a credential.
Secrets (A password, key or token that gives access to a system, left in a file by mistake.) served to the public. Service versions are recorded, and known vulnerabilities in running services are found by the network and web checks.
Accounts and their configuration, against the provider's own rules and the benchmark (A published list of secure settings for one kind of system, checked one control at a time.).
Laptops and workstations, including remote ones, judged from what an agent on each machine reports. The agent connection is not available yet.
Secure settings on hosts, control by control, with the command and its output kept as evidence.
Prompt injection (Text that tricks an AI model into ignoring its instructions.), data exposure and the permissions handed to tools.
Whether an attacker on the path could read or alter the traffic: TLS (Transport Layer Security. The encryption that protects traffic between a browser or app and a server.) enforcement, HSTS (HTTP Strict Transport Security. A setting that tells browsers to use only encrypted connections to a site.), cookie flags, mixed content (An encrypted page that loads some of its parts without encryption.), and secrets carried in URLs.
Every check ends as tested, not applicable, or not done. A check that was not done is recorded with one of 20 reasons, such as no credential, host unreachable or out of scope.
Every report opens with this list. So a gap is never mistaken for a clean result, and you know what to set up before the next scan.
Each finding carries what the scanner saw: the request and the response, or the command and its output. Your team can trust a finding, or dismiss it, without running the scan again.
Each scan names what is new, what has been fixed and what is still open since the last one, so progress shows scan by scan.
Reports, made when a scan ends
For sending, filing and signing off, with every finding and its evidence.
For sorting, for scripts, and for the tools that read them.
What still needs a manual tester, taken from the scan's coverage.
Confirmed, inferred from a version, or suspected, with the steps to check it yourself.
Forty web servers behind one load balancer (A server that shares incoming traffic between several other servers.) may all lack the same security header. That is one change, not forty problems. Ivy Insight groups the findings that share a fix into one action.
The fix plan ranks the actions by how much risk each one removes. Your team can start with the change that removes the most.
Rules you set give each finding an owner, based on what the asset (One thing you add to Ivy Insight to be checked, such as a host, a domain, a website, an API or a cloud account.) is. The owner can be a person or a team.
The deadline counts from the day the finding was first seen, so ignoring a report does not reset it.
By default, at most
Deadlines are shorter on systems open to the internet. Your own policy can change them.
A scan can run by hand, once at a set time, every day, or on chosen days of the week. The time is a local time in the schedule's own time zone, and it stays right when the clocks change.
If the person who set a schedule loses the right to scan, the schedule turns off, with the reason.
Which findings attackers already use, how a site could be attacked, and answers to your questions, all from the scan's own evidence.
Each finding's risk score counts its severity, how much the asset matters, and how exposed the asset is. A finding on CISA's (Cybersecurity and Infrastructure Security Agency. The cybersecurity agency of the United States. It publishes the list of known exploited vulnerabilities.) Known Exploited Vulnerabilities catalogue scores higher, and so does a high EPSS (Exploit Prediction Scoring System. A daily score for how likely a vulnerability is to be exploited in the next 30 days.) score.
So a medium finding that attackers already use can rank above a critical one on an internal system.
Ivy Insight draws one website, asset or scan from what the scan observed: the findings, the coverage records and the facts on the asset. Every part is marked observed, inferred, assumed or not observed.
Each threat links to the findings behind it, with its STRIDE (Spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. The six kinds of threat used in threat modelling.) category. Threats that were not tested are listed apart and never rated. An attack path is shown only when every step of it was observed.
With two accounts you provide, the API engine signs in as each one and checks whether one can read the other's records. This weakness, broken authorisation, is common in APIs.
Without two accounts this cannot be tested, and the coverage record says so.
The frameworks decide which checks the engines run. Each finding is also mapped to the standards an auditor asks about.
A scan can be limited to one framework. The report then shows how much of each category was attempted.
Every part installs on your own hardware, even with no internet connection: the database, the control plane (The central server that plans the scans and keeps the results.), the interface and the workers (The part that runs the checks, close to the systems it checks.). Ivy Insight can also run as a service.
The control plane plans the scans and keeps the results. The workers run the checks, close to the systems they check.
One credit (The units a scan is paid with. You pay for the scans you run, not for each user.) for each asset and engine, from a balance you can see. You pay for scans, not for each user. The licence also sets how many workers an organisation can enrol.
The data about your systems goes only where you tell it. The one exception is attack surface discovery, which looks up your domain name in public subdomain sources. A stored credential is encrypted, and no user can read it back.
Write to info@visiminds.com. Ivy Insight complements Ivy Lens, which checks the code you build.