Vulnerability Management

Vulnerability Management finds the known security flaws (CVEs) affecting the devices you manage, ranks them by how much they actually matter, and gives you a clear path to act on each one – deploy a patch, formally accept the risk for a set period, or record a compensating control. It cross-references the software and operating-system versions Breeze already inventories against authoritative vulnerability feeds, so there is nothing to install or scan separately – but scanning is opt-in per scope and off by default, so you turn it on for the organizations you want covered (see Enabling vulnerability scanning).

This page is the operator’s guide. Fixes are usually deployed through Patch Management, and vulnerability posture also feeds the Security overview and the AI agent.

Open Vulnerabilities from the Security section of the left sidebar for the fleet-wide view, or open any device and select its Vulnerabilities tab for a single machine.

Enabling vulnerability scanning

Vulnerability scanning is off by default. A device only produces findings once it’s covered by a configuration policy that turns scanning on, so you can roll the feature out organization by organization instead of flooding every customer at once.

1. Go to Configuration → Policies and open (or create) a policy.
2. On the Vulnerability feature tab, switch Enable vulnerability scanning on, and save.
3. Assign the policy to the scope you want covered – a partner, organization, site, device group, or individual device.

Coverage follows the same closest-wins inheritance as every other policy feature: a device- or group-level setting of off overrides an organization-wide on, so you can enable scanning broadly and carve out exceptions. Once a scope is enabled, Breeze correlates its inventory against the CVE feeds once a day (around 13:00 UTC, after the feeds refresh) and populates the findings below. Platform administrators can also trigger a correlation pass on demand.

Note

Enabling is deliberate: if no device anywhere has scanning turned on, the daily job simply does nothing – it never falls back to scanning your whole fleet. See Configuration Policies → Vulnerability Scanning for the full feature.

What you can do

• See every open CVE across your fleet, ranked by risk, with the number of affected devices.
• Drill into one device to see its findings and act on them.
• Deploy the fixing patch directly from a finding when one is available.
• Accept a risk for a defined period (with a reason), or mark it mitigated by a compensating control.
• Let the AI agent report on vulnerabilities and propose remediations for your approval.

The fleet dashboard

The Vulnerabilities page aggregates open findings across every organization you can access, one row per CVE:

Column	What it shows
CVE	The vulnerability identifier (e.g. CVE-2024-1234).
Severity	Critical / High / Medium / Low, color-coded.
CVSS	The standard 0–10 base severity score (shown as — until scored).
Risk	Breeze’s prioritized 0–100 score (see Risk scoring).
Devices	How many of your devices are affected by this CVE.
Known exploited	Flagged when the CVE is on CISA’s Known Exploited Vulnerabilities list.

Use the Severity filter to narrow the list. The dashboard is a read-only, prioritized overview – you take action from the per-device tab, where remediation can be tied to the specific machine.

The per-device tab

Each device’s Vulnerabilities tab lists that machine’s findings and is where you act. A status filter switches between Open (default), Accepted, Mitigated, Patched, and All. Open findings show their CVE (with a Patch available badge when an installable fix exists), severity, status, CVSS, risk, known-exploited flag, and per-row actions.

Action	What it does	When available
Remediate	Schedules the patch that fixes this CVE on this device.	Open findings with an available, approved patch.
Accept risk	Records a formal, time-boxed risk acceptance with a reason.	Any open finding.
Mitigate	Records that a compensating control reduces this risk.	Any open finding.
Reopen	Returns an accepted or mitigated finding to open.	Accepted / Mitigated findings.

When patches are available for several findings, select them and use Remediate selected to schedule them together.

Note

A finding moves to Patched on its own: once the device reports a software or OS version that is no longer in the vulnerable range, Breeze closes the finding automatically. You don’t mark something patched by hand.

Accept risk vs. mitigate

Both keep a finding off your open list, but they mean different things:

• Accept risk is a governance decision – “we acknowledge this and choose to live with it until a date.” It requires a reason and an Accepted until date. When that date passes, a nightly job automatically reopens the finding so it can’t be quietly forgotten.
• Mitigate is a technical assertion – “a control (a firewall rule, a disabled feature) reduces this risk.” It requires a note and stays in effect until someone reopens it.

Where the data comes from

Breeze pulls vulnerability intelligence from several authoritative feeds and refreshes them on a schedule. The feeds themselves need no setup – they are always kept current; you only choose which scopes to scan against them (see Enabling vulnerability scanning). The sources:

Source	Used for
NIST NVD	The core CVE catalog, CVSS scores, and affected-version ranges for third-party software.
Microsoft MSRC	CVEs and fixed builds for Windows and Microsoft products.
Apple SOFA	CVEs and fixed builds for macOS releases.
CISA KEV	Marks CVEs that are known to be actively exploited.
FIRST EPSS	A probability that a CVE will be exploited in the near term.

Tip

Self-hosted operators can set an optional NVD_API_KEY to raise NVD’s request rate limits and speed up syncs. It’s not required – without it, syncs simply run at the slower public rate. See the environment reference.

How risk is scored

The Risk score (0–100) is designed to surface what attackers are most likely to use against you, not just what scores highest on paper. It builds on the CVSS base score and then adjusts for real-world signals:

• CVSS severity is the spine of the score.
• Active exploitation (KEV) lifts a finding into high-priority territory regardless of its base score – a “medium” CVE that is being exploited in the wild should not sit at the bottom of your list.
• Exploit likelihood (EPSS) nudges the score up when a flaw is statistically likely to be weaponized soon.

The result is that a moderately-rated but actively-exploited vulnerability can outrank a higher-CVSS flaw that nobody is using. Scores refresh hourly, so newly-exploited CVEs re-prioritize themselves without any action from you.

Permissions

Permission	Allows
devices:read	View the fleet dashboard and per-device tab.
devices:execute (plus MFA)	Schedule remediation (patch installs) from a finding.
vulnerabilities:accept_risk	Accept a risk, and reopen an accepted or mitigated finding.
devices:write	Mark a finding mitigated.

Risk acceptance is deliberately gated by its own permission so that formally waiving a critical or actively-exploited finding is a higher-trust action than everyday device work.

With the AI agent

Vulnerability data is available to the Breeze AI agent: it can summarize fleet-wide vulnerability posture, list a device’s findings, and – with your approval – schedule remediations. Critical detections and remediation activity also appear on the device event timeline, so they can drive automations. See AI Agent.