Unified vulnerability management and finding intelligence
VulnFlow is the enterprise platform where a security team manages every vulnerability it finds, prioritizes, assigns, tracks and closes, from source code (razeSAST) to live applications (ZFPScan), from third-party components (razeINTEL CVE/SBOM) to SSL certificates and Nessus outputs, on a single panel. One address, one identity, one permission matrix, one reporting pipeline. Six separate tools, six separate logins, six separate reports. Not anymore.
Twelve core capabilities that carry your vulnerability operations end to end: from code analysis triage to CVE intelligence, from SBOM analysis to kanban workflow and branded reporting.
SAST, DAST, SCA/CVE, certificates, Nessus and vulnerability workflow converge on a single platform. DAST findings flow into VM as a mirror. A single source of truth is preserved. "Which vulnerability is where, on whom, in what state?" finally has one answer. Excel files and email chains become history.
Imports Fortify FPR and Checkmarx XML outputs and enriches them with the proprietary Raze Rules knowledge base: readable explanations, multi-language sample code, CWE references and remediation guidance. Syntax highlighting in 16+ languages, line-level highlighting and Source→Sink data-flow analysis deliver a complete scan → triage → assign → fix → verify loop.
Scans your web application, API and domain inventory live: OWASP Top 10, SQLi and XSS profiles. 6 different authentication methods. HTTP request/response evidence on every finding. With the external Invicti integration and Burp/Acunetix imports, all dynamic findings pool in one repository. Retest and incremental scanning verify closure.
Every finding is managed through a 9-state lifecycle: Opened → In Progress → Closed plus On Hold, Rechecking, False Positive, Risk Accepted, Reopened. A 14-filter list, rich-text notes, file attachments, status transitions with mandatory comments and a version history showing each field's old and new values side by side.
A CVE database of 330,000+ records fed from NVD, MITRE and GitHub. Actively exploited vulnerabilities on the CISA KEV list are flagged separately. A multi-source matching chain, OSV → GitHub Advisory (semver-precise) → NVD CPE, pairs every component with the right CVE. With the EPSS score and KEV flag, priority is set by intelligence, not guesswork.
Upload a CycloneDX/SPDX SBOM or import dependency manifests. Your npm, PyPI, Maven, NuGet, Go and Cargo components enter the inventory. Every component passes through automatic CVE matching. Vulnerable, outdated and EOL components are reported per target, and a component that lands on KEV instantly becomes an alarm.
Every target's certificate grade (A+ to F), protocol distribution (TLS 1.3 down to SSLv3), HSTS status and days remaining in a single inventory. 73 different SSL/TLS vulnerability types are detected and resolved with bulk triage. The expiry timeline never lets a certificate take a service down at midnight.
.nessus files are imported with a live progress stream. Findings settle into the same status and category structure as VM. A 14-filter panel, configurable columns, bulk assignment and reminder emails, PDF/CSV/Excel export. Nessus output is no longer a report circulating as an attachment but a managed work queue.
Severity-based SLAs with per-project overrides. Time is calculated in business hours (8h/day, excluding weekends and holidays) and pauses On Hold. Warning → breach → email escalation runs automatically. Findings marked "Fixed" are verified with a retest, and anything unverified is reopened. Closure rate and mean time to fix are ready in the management report.
Sign in with a local password or LDAP/Active Directory. MFA with TOTP, email OTP and SMS support, plus single-use recovery codes. Users can view their active sessions and revoke them one by one. Permissions live in a product × action matrix. The same person can be an Admin in SAST and a Viewer in DAST. A departing employee's entire access is closed in one move.
Group-based vulnerability ownership: a drag-and-drop kanban board (9 status columns), status changes with mandatory comments on card drop, threaded discussions and file sharing. Group health score, open vulnerabilities per member and an activity ledger. Analyst performance is tracked transparently on a leaderboard.
All modules produce branded PDFs in the same design language: executive summary, month-over-month score change, CWE→OWASP mapping and 9 compliance formats (PCI-DSS, HIPAA, OWASP 2021/API 2023…). Who changed what and when. All of it in the audit log with IP and device info. Audit evidence exports to CSV in one click.
Click a heading on the left to see each module's real interface and how it is used in the field on the right.
All modules' findings on a single board: total vulnerabilities, severity distribution, source-based breakdown and trend sparklines. Clicking a card auto-filters the list. The executive sees the organization's risk snapshot at a glance over morning coffee.
A 0–100 security score, SLA compliance, unassigned findings and a vulnerability aging chart on one screen. The panel refreshes itself every 60 seconds. Fortify/Checkmarx scans are imported and enriched with the Raze Rules knowledge base. The team tracks in real time who is assigned what and which finding is pushing the SLA.
Your web application, API and domain targets sit in the inventory with environment (prod/staging/dev) and criticality tags. Weighted security score, unresolved findings, finding-age distribution and SSL compliance are monitored in real time. The most vulnerable targets are listed at the top, without hiding anything.
All findings are sifted through 14 filters (severity, status, category, asset, source, assignee, tag, date…). Bulk assignment, archiving and reminder emails go out with a single selection. Excel/SQL/Nessus imports flow with live progress. Every finding's notes, status history and old-vs-new version comparison live on a single detail screen.
330,000+ CVE records, 1,400+ CISA KEV (actively exploited) entries and the latest KEV discoveries, synchronized 24/7 from NVD, MITRE and GitHub. Every component in the inventory passes through the OSV → GitHub Advisory → NVD CPE chain. The answer to "is this vulnerability actually being exploited?" is on the board with EPSS and KEV data.
Every target's certificate grade (A+ to F), protocol distribution (TLS 1.3 down to SSLv3), HSTS status and soon-to-expire certificates on a single board. 73 SSL/TLS vulnerability types are detected and managed with bulk triage. It never lets a single expiring certificate take down an entire service at midnight.
Monday: The ZFPScan scan results are in. The team sees the alarms for components that entered KEV and plans remediation for the 3 critical applications.
Wednesday: The Fortify scan of the new online banking release is uploaded to razeSAST. No criticals, the deploy continues.
Thursday: External pentest findings have been entered into the VM workflow. The CISO produces an executive PDF in one click.
Friday: The audit team exports all finding and audit records from the last 30 days. A 5-minute job.
A holding connects all of its security and development teams to the platform via LDAP/Active Directory, nobody memorizes a new password, and MFA is enforced by corporate policy.
Each team sees only its own group's vulnerabilities. Findings approaching SLA breach send automatic reminders to their owners and escalate to the manager by email after N days.
In an ISO 27001 audit, the answer to "who changed what, and when" exports from the audit log as a CSV in one click.
A 30-person fintech startup has hired a new security manager. Instead of 5–6 separate SaaS subscriptions, they buy VulnFlow Platform.
In 1 day the whole team is onboarded: razeSAST triage for development, ZFPScan DAST for the application team, group-based restricted access for the external pentest firm.
On one invoice, in one interface, in two languages (TR/EN).
Modern security teams use 8–12 different tools on average. Each one means a separate login, separate role management, separate report. VulnFlow closes this fragmentation on three planes:
Instead of a separate login and role definition per tool, a single session and a single product × action permission matrix, with MFA and LDAP/Active Directory support. A departing employee's entire access is closed from one place, in one move.
Findings don't wait uncorrelated in separate silos. DAST findings flow into VM as a mirror and a single source of truth is preserved. The code, live-application, component and certificate projections of the same vulnerability appear side by side.
No six different PDF formats go to the customer. All modules produce brand-consistent reports in the same design language, including 9 compliance formats (PCI-DSS, HIPAA, OWASP 2021/API 2023…). Audit evidence comes out of the central audit log in one click.
All modules' findings and metrics in one dashboard: total findings, users and sources at a glance.
Vulnerability management is more than a list of findings. Architecture, imports, authorization and licensing: the four layers that make the platform enterprise-grade, in one place.
The user sees a single application. Behind the scenes every product keeps running in its own service with its own database. Unification happens at the identity layer, not in the data.
The browser sees only one address. The reverse proxy routes requests to the central identity service and product endpoints. When one service is under maintenance, the others keep running.
Identity is shared across all services via an httpOnly JWT cookie that JavaScript cannot access. The token never sits in localStorage and cannot be stolen via XSS.
Product databases are not merged. Each module runs with its own PostgreSQL database. The only bond between modules is the user's identity. A problem in one module cannot touch another's data.
Integration credentials such as SMTP, SMS and LDAP service accounts are stored encrypted with AES-256-GCM and are never shown back in the interface.
You don't have to throw away your existing scanners and reports. VulnFlow moves everything into a single repository and runs the workflow automatically.
Large scanner outputs (up to 300 MB) upload in chunks and are reviewed in a staging area before commit: apply or discard. Nessus and SQL imports run with a live progress stream. A faulty import can be rolled back.
All products' users in one directory, all permissions in one RBAC matrix. Authorization debates end. You talk with the matrix, not with screenshots.
The identity service and all product databases are scanned and merged into a single list. Per-product roles, active/passive and lock status, 2FA and LDAP info on a single row. Bulk activation, password reset, unlock and CSV export in one click.
Roles are managed with full CRUD: a tiered View → Add/Edit → Delete logic and dependency rules that never leave inconsistent permissions. Wildcard permissions (sast:*) automatically cover their sub-permissions.
The entire role × permission intersection appears on a single page as green checks / grey crosses and exports to CSV for audits. Role assignment history is tracked from real audit records. Every button in the interface hides by permission, and the endpoint rejects unauthorized calls with a 403.
Three packages, one platform. The license panel transparently shows your package, the licensed party, days remaining and usage metrics. The feature comparison matrix makes clear which capability ships in which package.
EN
