Vulnerability management
The loop that turns noisy scanner output into validated findings with owners, retest dates and evidence that closes them.
The loop, not the scan
Scanner output is noisy, developers are busy, and leadership needs clarity. Vulnerability management is the workflow that turns raw findings into closed work, and it keeps running between audits.
| State | What it means |
|---|---|
| Queued | New scanner records and exposure signals, not yet reviewed |
| Review | Clustered and summarized, awaiting human validation |
| Fixing | Validated, with an owner, remediation note and retest date |
| Closed | Retested, with the evidence attached |
What the AI does
Agents collect signals, normalize messy scanner output into comparable records, cluster related findings, draft summaries, suggest owners, and flag likely false-positive patterns.
Every summary points back to its underlying evidence — URL, asset, timestamp, scanner record, screenshot or manual note. A summary you cannot trace to evidence is not something to act on, and Boni does not produce one.
What stays human
Scope, severity, validation and disclosure. AI compresses and routes; a person decides whether a suspected issue is real, how much it matters to your business, and what gets said to whom.
Confidence states stay separate
| State | Meaning |
|---|---|
| Public observation | Something visible from outside, not yet a claim about risk |
| Suspected issue | Looks like a problem, not yet validated |
| Validated vulnerability | Confirmed to be real |
| Accepted risk | Real, understood, and deliberately not being fixed |
| Fixed finding | Remediated and retested |
Keeping these apart is what stops a dashboard from either crying wolf or hiding a real problem inside a count.
Why it compounds
Assets, recurring patterns, past false positives and accepted-risk decisions stay in the same records. The next cycle inherits them, so review gets cheaper over time instead of restarting at zero — and a finding that reappears is visibly a regression rather than a new discovery.
Reporting
The same records produce the working view for engineers and the summary for leadership, customers or procurement. Translating one into the other does not require rewriting the technical truth, because both read from the same evidence.
Related: Web and API audits, Audit readiness.