CVEs, WAF and threat response
Vulnerability findings matched to what is genuinely installed, and what you can do from the finding.
CVEs against real inventory
The agent reports the packages each host actually has, at the versions it actually has. Findings are matched against that inventory — so a finding is about your machine, not about software you do not run.
This is the difference between a vulnerability report you act on and one you learn to ignore.
The WAF
Managed centrally and applied fleet-wide, so a rule you add is a rule everywhere rather than a change to make on each box and then verify on each box.
Acting from the finding
Block, quarantine or scan directly from the threat feed entry. The alternative — read an advisory, work out which machine, go to that machine — is where the time goes.
Scanning
Report-only antivirus scans can be run over a peer’s own paths, and the result is readable through the same API as everything else. A scan that failed carries null counts rather than zeros, because zero findings and no scan are different facts.
Proof, not posture
Backups are replayed by restore drills on a schedule, and the count is recorded. Compliance scores are derived from what the fleet is observed doing and signed. The point is to be able to answer "when did you last test that?" with a date rather than a policy.