AI Vulnerability Management in Romania

From inventory to a short priority list

Without an inventory there is nothing to manage, so we begin with a list of servers, containers, images, libraries and exposed services. On top of it run scheduled scans: Trivy and Grype on images and dependencies, OpenVAS on the network and operating system, Nuclei on the web surface. Raw output is always too long for any team, so it goes through prioritisation, and what reaches your work list carries three clear attributes: how exposed the asset is, how likely exploitation is and what the fix costs.

• Asset inventory with owner and environment
• Scans of images, dependencies, systems and network
• Ranking by CVSS plus EPSS plus CISA KEV
• Attack-path analysis and real exposure
• Deadlines by severity, tracked until closure

How AI changes the race between scanner and exploit

On the attacker side, LLM agents read the security advisory, write an exploit and try it at scale within hours of publication. A window that used to last months now lasts hours, and targets are picked automatically from the fingerprint of the exposed version. On our side AI solves the opposite problem: from thousands of findings it extracts the few that are reachable from the internet, have public exploit code and lead to something important. We use probability scores, attack-path analysis and log correlation, then validate by hand before a ticket is opened.

Fixing, virtual patching and proof

A priority without execution changes nothing. For every finding we open a task with a deadline: a package update, a new image version, a configuration change or a tighter access rule. When the update needs testing or depends on a vendor, we put a virtual patch in the WAF, close the port or limit the route in the meantime. After the fix we rescan and attach the evidence, so the list closes with verification rather than a tick. What cannot be fixed stays as an explicit accepted risk with a reason and a review date.

The monthly rhythm and what uses the hours

The cycle has a fixed beat: scan, prioritised list, fixes, report. You request the service from the DevOps Services section of the client panel. The hours in your plan (1 h on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated by plan, 10 h on GPU) usually go on reviewing the list, small fixes and adjusting the scans. A wave of major upgrades or a version migration exceeds the allowance, and the surplus is billed separately after you accept the estimate. Unused hours do not carry over.

How we work

1. Request from the panel

   Request the service in DevOps Services, tell us which environments are in scope and propose the date for the first full scan of your infrastructure.

2. Inventory and calibration

   We build the asset inventory, set severities and remediation deadlines, and agree who receives the report. Noise is reduced with documented exceptions.

3. Scanning and fixing

   We run the scheduled scans, prioritise with EPSS and KEV, apply fixes from the included hours and add temporary controls where they are needed.

4. Monthly report and handover

   You receive the monthly report with trends, accepted risks and proof of remediation, plus a dashboard that shows the current state between reports.

Use cases

Technology stack

• Trivy
• Grype
• OpenVAS
• Nuclei
• Syft
• Dependency-Track
• Wazuh
• Ansible

Frequently asked questions

• What is vulnerability management?

  A continuous cycle: inventory your assets, scan, prioritise, remediate, verify and report. It differs from a pentest, which is a deep one-off assessment. Vulnerability management answers every week the question of what is exposed right now and what to fix first, rather than once a year.

• CVSS or EPSS: how do I decide what to fix first?

  CVSS says how bad a flaw could be in the worst case; EPSS estimates how likely it is to be exploited in the coming days. We use both, add the CISA KEV list for flaws already exploited and weigh the real exposure of the asset. A high CVSS in an unused library can wait.

• What is CISA KEV?

  The public catalogue of vulnerabilities known to be exploited in real attacks, kept by the US cybersecurity agency. If a CVE is listed there, the debate about severity is over: it gets fixed first, whatever its theoretical score, and we give it the shortest deadline.

• How quickly do attackers turn a new CVE into an attack?

  Today it is measured in hours from the advisory, not months: scanning the internet and writing the exploit are automated, and AI agents chain the steps together. That is why we keep short deadlines for anything in CISA KEV and apply temporary controls until the update is installed.

• Vulnerability scan or penetration test?

  Both, with different jobs. Scanning runs often and covers everything already known. A pentest looks for chains of flaws and broken logic that no signature sees. Scanning keeps your surface clean, while the pentest checks whether your defences hold in depth.

• How often should infrastructure be scanned?

  Images and dependencies on every build, systems daily, the network weekly and a full authenticated scan monthly. Frequency matters less than closing the loop: a scan that produces no tasks with deadlines does not reduce risk, so each cycle ends in tracked fixes.