Vulnerability Scanning

CyberOrigen provides AI-powered vulnerability scanning with an 11-phase pipeline for comprehensive security coverage.

Scanning Architecture

11-Phase Pipeline

CyberOrigen's agentic scanning follows a structured 11-phase approach:

Phase	Description
1. Discovery	Subdomain & port enumeration
2. Enumeration	HTTP probing, web crawling, tech detection
3. Vulnerability Scanning	Multi-tool security assessment
4. Correlation	Deduplication, attack chain detection
5. Threat Intelligence	IOC checking, SIEM correlation
6. Exploit Checking	Public exploit availability
7. Prioritization	CVSS + exploitability + business impact
8. Remediation	Automated fix playbooks
9. Verification	Re-scan to confirm fixes
10. Continuous Monitoring	Ongoing security posture assessment
11. Reporting	Generate audit-ready reports

Security Capabilities

CyberOrigen provides comprehensive security scanning across multiple domains:

Asset Discovery

• Subdomain enumeration
• Port scanning and service detection
• HTTP probing and technology fingerprinting
• Web crawling and endpoint discovery

Vulnerability Detection

• Template-based vulnerability scanning
• SQL injection detection
• TLS/SSL configuration analysis
• Static application security testing (SAST)
• CMS vulnerability scanning
• Container and dependency scanning

API & JavaScript Security

• API endpoint discovery
• JavaScript library CVE detection

Cloud Security

• Multi-cloud configuration auditing (AWS, Azure, GCP)

Threat Intelligence

• Threat intelligence platform integration
• SIEM correlation

Exploit Research

• Exploit database queries

Remediation & Reporting

• Automated remediation playbooks
• PDF/DOCX report generation

Plan Limits

Feature	Startup	Professional	Enterprise
Scans/Month	25	150	Unlimited
Targets	3	15	Unlimited
Scan History	30 days	90 days	Unlimited
Scheduled Scans	✓	✓	✓
24/7 Continuous	-	-	✓
CI/CD Integration	-	✓	✓

Need More Scans?

Purchase additional scan credits from Billing → Buy Credits.

Scan Types

Full Scan

Comprehensive assessment of your target:

• Network discovery
• Port scanning
• Service enumeration
• Vulnerability detection
• Configuration analysis

Duration: 30-60 minutes depending on scope

Quick Scan

Rapid assessment of critical vulnerabilities:

• Top ports (1-1000)
• Known CVEs
• Critical misconfigurations

Duration: 5-10 minutes

Compliance Scan

Framework-specific security checks:

• SOC 2 security requirements
• PCI-DSS technical controls
• HIPAA security rule
• ISO 27001 Annex A controls

Duration: 15-30 minutes

Custom Scan

Configure scan parameters:

• Port ranges
• Specific checks
• Exclusions
• Scheduling

Starting a Scan

Via Dashboard

1. Navigate to Scans → New Scan
2. Enter target (domain, IP, or CIDR range)
3. Select scan type
4. Configure options (optional)
5. Click Start Scan

Via API

curl -X POST https://api.yourdomain.com/api/v1/scans \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "target": "example.com",
    "scan_type": "full",
    "frameworks": ["soc2", "pci-dss"]
  }'

Scheduled Scans

Set up recurring scans:

• Daily
• Weekly
• Monthly
• Custom cron expression

Scan Results

Vulnerability List

Each finding includes:

Field	Description
CVE ID	Common Vulnerabilities and Exposures identifier
Severity	Critical, High, Medium, Low, Info
CVSS Score	0.0 - 10.0 numerical severity
Affected Asset	IP, hostname, or service
Description	What the vulnerability is
Remediation	How to fix it

Severity Distribution

Critical ██████░░░░░░░░░░░░░░  5
High     ████████████░░░░░░░░ 12
Medium   ██████████████████░░ 28
Low      ████████████████████ 45
Info     ██████████░░░░░░░░░░ 15

AI Analysis

CyberOrigen's AI provides:

• Prioritization: Which vulnerabilities to fix first
• Context: Business impact assessment
• Remediation: Step-by-step fix instructions
• Verification: How to confirm the fix worked

Compliance Mapping

Vulnerabilities automatically map to compliance requirements:

┌────────────────────────────────────────────────────────────┐
│ CVE-2024-1234: SSL/TLS Weak Cipher                        │
├────────────────────────────────────────────────────────────┤
│ Severity: HIGH (CVSS 7.5)                                  │
│                                                            │
│ Affects Compliance:                                        │
│ • SOC 2 CC6.7 - Encryption in Transit                     │
│ • PCI-DSS 4.1 - Strong Cryptography                       │
│ • ISO 27001 A.10.1.1 - Cryptographic Controls             │
│ • HIPAA 164.312(e)(1) - Transmission Security             │
└────────────────────────────────────────────────────────────┘

Asset Discovery

Scans automatically discover:

• Domains and subdomains
• IP addresses
• Open ports
• Running services
• SSL certificates
• Technologies in use

Asset Inventory

View discovered assets:

GET /api/v1/assets

Response:

{
  "items": [
    {
      "id": "asset_123",
      "type": "domain",
      "value": "api.example.com",
      "first_seen": "2025-12-01T10:00:00Z",
      "last_seen": "2025-12-21T14:00:00Z",
      "services": [
        {"port": 443, "service": "https", "version": "nginx/1.24"}
      ]
    }
  ]
}

Integrations

Export Formats

• PDF Report
• CSV/Excel
• JSON (API)
• SARIF (Security Analysis Results Interchange Format)

Ticketing Integration

Automatically create tickets for findings:

• Jira
• GitHub Issues
• Peppermint (built-in)
• Custom webhook

Notifications

Get notified when scans complete:

• Email summary
• Slack/Teams webhook
• In-app notification

Best Practices

1. Regular Scanning: Run full scans weekly, quick scans daily
2. Scope Management: Define clear scan boundaries
3. Remediation SLAs: Set fix timelines by severity
4. Trend Analysis: Track vulnerability counts over time
5. Verify Fixes: Rescan after remediation

Scan Policies

Create policies to enforce standards:

name: Production Infrastructure
targets:
  - 10.0.0.0/24
  - prod.example.com
schedule: "0 2 * * 0"  # Weekly at 2 AM Sunday
scan_type: full
frameworks:
  - soc2
  - pci-dss
notifications:
  - email: [email protected]
  - slack: "#security-alerts"
thresholds:
  critical: 0  # Fail if any critical found
  high: 5      # Warn if more than 5 high

Troubleshooting

Scan Won't Start

• Check target is reachable
• Verify scan quota hasn't been exceeded
• Ensure target is within allowed scope

Incomplete Results

• Target may be blocking scans
• Network timeouts
• Large target scope

False Positives

• Mark as false positive in UI
• AI will learn from feedback
• Contact support for persistent issues