Cap 1
One graph for every scanner
Assets, components and findings from every source, connected once. Click through from asset to finding to owner.
UI · graph
Business initiative
Unified Vulnerability Management (UVM)
Five scanners, five formats, five backlogs. UVM consolidates infrastructure, cloud, AppSec and container findings into one normalized view and one workflow across Security and IT, and Zafran is built to be that layer.
UI · Unified findings graph
Definition
What UVM means
Unified Vulnerability Management (UVM) consolidates vulnerability data from every scanner and asset class into a single, normalized and de-duplicated view with one prioritization model and one remediation workflow. It replaces the swivel-chair work of reconciling scanner outputs and gives Security and IT a shared queue.
What buyers expect from an UVM program
- Ingest infrastructure, cloud, AppSec and container scanners into one normalized, de-duplicated data model
- One risk score and one queue across all sources, with clear ownership
- A single remediation workflow that reaches IT, DevOps and application teams in the tools they already use
Mapping
How Zafran maps to your UVM program
Take the requirements column from your RFP; the other two columns are what Zafran delivers and where it sits in the lifecycle.
| Program requirement | Zafran capability | Lifecycle stage |
|---|---|---|
| Consolidate all vulnerability sources | Connectors for infrastructure, cloud, AppSec and container scanners feed one exposure graph with no new agents | 01Continuous Discovery & Detection |
| Normalize and de-duplicate findings | The same CVE on the same asset from three scanners becomes one finding with full provenance | 01Continuous Discovery & Detection |
| One prioritization model across sources | Exploitability scoring applied consistently to every finding regardless of which scanner produced it | 02Assess & Validate |
| One workflow across Security and IT | RemOps groups by root cause, opens tickets in ServiceNow or Jira and tracks them to closure | 04Remediation Workflows |
| One report for the whole estate | Coverage, SLA and risk trend reporting spanning every scanner and asset class | 05Reporting & Analytics |
Capabilities
UVM capabilities, in the product
Stylized dashboard callouts; each tile becomes a short micro-animation in production.
Cap 2
Coverage by source
Which scanners cover which assets, and the gaps between them.
UI · donut
Cap 3
Normalized findings table
De-duplicated across sources, with provenance, score, owner and status.
UI · table
Cap 4
Three tickets become one
Findings that share a root cause collapse into a single ticket for the team that can fix them.
UI · tickets
RFP checklist
Evaluating UVM vendors? Start here.
Download
UVM evaluation checklist
Requirement language, scoring criteria and proof-of-value tests you can paste into an RFP.
- Which scanner and cloud sources are supported natively, and how are new ones added?
- How are duplicates identified across scanners, and is provenance preserved?
- Is the same prioritization model applied to every source?
- Which ticketing and ITSM systems are supported for two-way sync?
- Can reporting show coverage gaps between scanners as well as risk?
Outcomes
What UVM teams see with Zafran
5+
scanner sources consolidated in a typical deployment
-70%
fewer duplicate findings after normalization
1
queue shared by Security and IT
Illustrative figures for the wireframe; replace with validated customer outcomes.
“Zafran is tackling vulnerabilities from a hacker's perspective, adding a true layer of risk mitigation through compensating controls.”
Ricardo Lafosse
CISO, Kraft Heinz
“Zafran lets us evaluate the effectiveness and ROI of our security stack against what is actually exploitable.”
Dave Estlick
CISO, Chipotle
FAQ
Frequently asked questions
What is UVM?
Unified Vulnerability Management consolidates findings from every scanner and asset class into one normalized, de-duplicated view with a single prioritization model and remediation workflow.
UVM vs RBVM?
UVM is about consolidating sources into one view; RBVM is about prioritizing that view by real risk. Zafran does both on the same exposure graph.
Does Zafran replace my scanners?
No. Zafran unifies the scanners you already run. You keep those investments and get one place to act on their output.
Which sources does Zafran ingest?
Infrastructure, cloud, AppSec and container scanners plus EDR, CMDB, identity and cloud provider APIs. See the Platform integrations section for the current list.
How does UVM fit CTEM?
UVM is the discovery and remediation-workflow backbone of a CTEM program. Zafran delivers it as part of the full lifecycle rather than as a separate aggregation tool.
Bring Zafran into your UVM evaluation
See how the platform maps to your requirements, on your data, in a 30-minute walkthrough.