NacTrack
FRGet the demo
Product

Find out which devices a new CVE actually reaches

NacTrack matches published CVEs against the versions you have installed, not against a vendor family. It flags end of support the same way.

Free network audit
The mechanism

Why the exact version changes everything

A vulnerability does not affect a model, it affects specific software versions of a model. Without the exact version you patch what does not need it and miss what matters.

NacTrack knows the version because it read it off the device. Matching against the catalogue becomes mechanical, and the list of affected devices is by name.

  • Matched by version, not by model
  • Severity, known exploitation, likelihood
  • The fixing version named
  • Catalogue updatable offline
  • Export for a security committee
The matching

From the software read to the named finding

The link that decides everything is the second. Matching on the model instead of the version names devices that are not affected and misses ones that are.

CVE matching chain: device, exact version, normalised platform, catalogue, findingFive links. The device is queried read only. The exact version comes from a command output and not from an inventory file. The platform is normalised from vendor, model and software family. The catalogue supplies affected versions, severity and vector. The finding then applies to that specific device, with whether exploitation is known and which version fixes it.READ FROMRead only sessionDevicewhat is runningCommand outputNot an inventory fileExact versionnot the planned oneVendor and modelSoftware familyNormalised platformone vocabularyAffected versionsSeverity and vectorCataloguepublished continuouslyKnown exploitationFixed versionFindingon this device

READ FROM

  1. Devicewhat is running
  2. Exact versionnot the planned one
  3. Normalised platformone vocabulary
  4. Cataloguepublished continuously
  5. Findingon this device

The catalogue transfers by file on an installation with no internet access: this link does not depend on a permanent connection.

End of support

End of support, the other missing inventory

  • A device past support does not fail on the announcement date. It becomes unrepairable.
  • You find out on the day it fails: the part no longer exists, the contract no longer covers it.
  • No fix will ship for the next vulnerability that reaches it.
  • NacTrack keeps an end of sale and end of support catalogue per model and matches it against the real estate.
  • The result is a dated list, usable to build a replacement plan and to defend it in budget.
  • It is the information most often missing at audit, because producing it requires a current inventory.

Hardware lifecycle has a page of its own: the five states, the at risk window, and what the catalogue does not cover.

app.nactrack.com/compliance/vulnerabilities
Published vulnerabilities matched against the versions read from the estate
The findings, matched version by version. Each line names the device affected, the version it carries and the one that fixes it.

Know what your estate is exposed to

Free network auditEnd of life and end of supportSee the demo