Posture — vulnerability management
Most tools bury you in findings. 786 Cyber’s Posture dashboard does the opposite: it ranks what to fix first based on real‑world risk to you, and explains each finding in plain English.
Find it under Technology & Threats → Posture in the side navigation (/posture).
How findings are prioritised
Section titled “How findings are prioritised”Instead of ranking by severity alone, 786 Cyber combines several signals:
- CVSS — the base technical severity of the vulnerability.
- EPSS — the probability it will actually be exploited.
- KEV — whether it’s on the Known Exploited Vulnerabilities list (i.e. being exploited in the wild).
- Asset criticality — how important the affected asset is to you.
The result is a single priority that pushes genuinely dangerous, exploitable issues on important assets to the top — and pushes low‑risk noise down.
The four posture lanes
Section titled “The four posture lanes”Findings are grouped into four lanes so you can see where your exposure sits. All four are live, shipped features. A lane only shows a score once it has data — until then it’s tagged Not configured and tells you what to connect, never a fake number or a claim that the feature itself isn’t built.
| Lane | What it covers | Where its findings come from |
|---|---|---|
| External Domain & IP | Internet‑facing exposure — open ports, services, domain and certificate issues | SSL Labs · Mozilla Observatory · Shodan · VirusTotal · DNSTwist · crt.sh |
| Application & Web | Web application vulnerabilities on your domains | OWASP ZAP · Mozilla Observatory · SSL Labs |
| Internal Asset | Known vulnerabilities in the software installed on your devices | Asset CVE matching (CPE → NVD) · Nuclei · asset criticality |
| Cloud Posture | Misconfiguration in your AWS, Azure or GCP accounts | Prowler (CIS benchmarks) · asset criticality |
Each lane needs a one‑off setup step before it fills:
- External runs automatically from onboarding — nothing to do.
- Application & Web needs a web scan enabled on a domain asset — see Assets.
- Internal Asset needs a software inventory imported, then CVE matching run. High‑confidence matches that are KEV‑listed or high‑EPSS graduate into this lane and score.
- Cloud Posture needs a cloud account connected on a cloud asset — see Connect a cloud account (CSPM).
A note on the Application & Web lane: the standard ZAP scan is a baseline (passive) scan — it observes and analyses your site without sending attack payloads. It is safe to run against production.
Active scanning has moved to Testing & Validation
Section titled “Active scanning has moved to Testing & Validation”Active scanning — sending real attack payloads to confirm whether a web-application vulnerability is genuinely exploitable — now lives in its own admin-gated section, alongside the platform’s other reconnaissance tooling and raw scan output. See Testing & Validation for how it works, the consent flow, and why it’s deliberately kept out of your posture score.
A note on the Application & Web lane above: it still fills from the baseline (passive) ZAP scan, which runs automatically once web scanning is enabled on a domain and is safe to run against production. Active scanning is the deliberate, admin-authorised step beyond that baseline — see Testing & Validation for the detail.
Managing what gets scanned
Section titled “Managing what gets scanned”Target enablement now lives directly on the dashboard that scores it, rather than a separate Scan Management screen: enable or disable your web-scan targets from the panel here on Posture, and your cloud-scan targets from the same kind of panel on Cloud Security. The Scans card on your Overview shows the same targets with their live status and a Run button for each.
Scans are started from the asset itself; these panels are where you choose what is in scope.
Working a finding
Section titled “Working a finding”- Open a finding to see its detail drawer — a plain‑English explanation of what it is, why it matters, and the affected asset.
- Use the status workflow to track it — findings move through Open → In Remediation → Resolved, or can be marked Accepted Risk where you have decided to live with the issue and can justify it.
- High‑priority findings also appear in Act on this on your Overview.
Downloading a report
Section titled “Downloading a report”Web and cloud scans both produce a branded PDF report — use Download report ↓ on the asset’s scan panel. The report includes a severity summary and per‑finding remediation guidance, which makes it useful for sharing with an assessor, a customer, or whoever is doing the fixing.
Scans: scheduled vs on demand
Section titled “Scans: scheduled vs on demand”- External monitoring runs automatically — at onboarding and then weekly. See External monitoring for what’s checked.
- Web and cloud scans run on demand — you start them from the asset’s scan panel, or from the Scans card on your Overview. They are not on an automatic schedule.
- The Run scan button at the top of the Posture dashboard re‑enriches and re‑scores your stored findings (refreshing exploitability data and priorities). It does not launch fresh scans — use the per‑target Run buttons for that.
A scan that fails is reported as failed, never as clean. If a scan cannot complete, you will see that rather than a false all‑clear.
Why it matters
Section titled “Why it matters”For everyday security: you get a short, honest list of what to fix first, with the reasoning shown — so limited time goes to the issues most likely to hurt you.
For compliance: vulnerability identification, prioritisation and remediation tracking are core to Cyber Essentials Plus, NCA ECC and SAMA CSF. The status workflow provides the remediation evidence assessors look for — a documented record of what you found, how you ranked it, and what you did about it.
Scan findings are not automatically counted as evidence against specific controls. Where a finding is relevant to a control, attach it yourself from the evidence vault so the link is deliberate and defensible.
Next: External monitoring →