Fixed isn't fixed until proven fixed.
vmp.one is the vulnerability management platform that automatically re-tests every remediated finding — so regressions are caught in hours, not at the next quarterly scan.
"Closed" tickets lie.
Every vulnerability management platform on the market closes the loop when a ticket closes. Real environments don't work that way. Dependencies update, configs drift, code rolls back, infrastructure gets recreated — and yesterday's fix is today's open hole.
A record-breaking pace. Your scanners surface them. Your engineers ship fixes. Then what?
CVE-2024-6387: an OpenSSH bug fixed in 2006 reappeared in 2020 via a refactor. By 2024 it was active in 14M servers. Nobody noticed.
In 2018 attackers needed 63 days. In 2024 exploitation routinely lands before the patch ships. A fix that quietly rolls back is a wide-open door.
We don't trust "fixed." We verify it.
Every remediated finding gets re-tested automatically on a schedule you set. When a fix silently rolls back, you find out in hours. Not at the next quarterly scan. Not from a customer. Not from an attacker.
- 1Engineer ships a fix and closes the ticket.
- 2A dependency update silently reintroduces the CVE.
- 3Months pass. The finding sits in 'resolved.'
- 4Next quarterly scan flags it again — or an attacker finds it first.
- 1Engineer ships a fix and closes the ticket.
- 2vmp.one re-runs the original check on schedule.
- 3A dependency update reintroduces the CVE — verification fails.
- 4Slack alert fires within hours. The fix re-opens automatically.
Re-test on your schedule
Daily, weekly, or after every CI/CD deploy. Configure per asset, per finding, per tenant.
Replay the original proof
Verification reuses the scanner, payload, and check that originally surfaced the finding — no false equivalence.
Regression alerts in real time
Slack, Teams, email, webhook. The engineer who closed the ticket hears about it before the auditor does.
Evidence trail per finding
Every re-test result is timestamped and signed into the audit log. Compliance reviewers stop asking for screenshots.
The orchestration layer your scanners are missing
Aggregate findings from any source, prioritize with real risk signal, route them to the right engineer, and verify the fix held. One platform, scanner-agnostic.
Continuous discovery
Pipe in any scanner — Nessus, Qualys, OpenVAS, Burp, Nuclei, Trivy, Snyk — or run the agent. Findings land in one timeline, not seven tabs.
Risk-aware prioritization
Rank findings with CVSS, EPSS, exploit maturity, and asset context. Engineering works the top of the queue, not the loudest finding.
Cloud posture & supply chain
AWS, Azure, GCP misconfiguration plus dependency analysis via Trivy and OWASP Dependency-Check — alongside traditional CVEs in the same view.
Incident response & SLA
Typed incident state machine, on-call rotations, GitHub PR check-runs, and Slack alerts the moment an SLA is at risk.
AI Copilot
Powered by Claude. Drafts remediation steps, explains findings to non-security stakeholders, and assembles compliance evidence from your tenant.
Multi-tenant by design
Isolated data, per-tenant branding, Keycloak SSO out of the box. Built for service providers from day one — not bolted on.
Live in days. Verifying forever.
Connect every source
Wire up your scanners, cloud accounts, and code repos. Findings start landing the same day — no quarterly snapshot, no spreadsheet export.
Prioritize and route
Each finding is enriched with exploit data, asset context, and your SLA. Tickets land in Jira, ServiceNow, Linear, or GitHub with the right owner attached.
Verify the fix held
Continuous Fix Verification re-runs the original check on schedule. Regression detected? The finding re-opens itself and your team gets paged.
Built for security teams and the firms they hire
One platform. Two operating models. Real multi-tenancy, not customer numbers in a column.
Security teams
Mid-market and critical-infrastructure teams stuck between a $150K ITSM-bolted platform and a stack of open-source tools held together with duct tape.
- Aggregate every scanner you already pay for — no rip-and-replace
- NIS2 and DORA evidence packs generated automatically
- Air-gapped on-prem deployment available on Enterprise
MSSPs, pentest firms, audit shops
Stop managing 5–50 client engagements in spreadsheets and shared drives. Run every client in its own isolated tenant, branded as yours.
- Per-client tenant isolation with white-label branding
- Hand clients read-only access to their own evidence trail
- Continuous verification doubles as proof of ongoing service value
The ground just shifted under vuln management
Regulators stopped accepting "we ran a scan"
NIS2 (October 2024) mandates continuous vulnerability management for critical sectors. DORA (January 2025) puts financial entities on the hook for up to 2% of global turnover. Both require evidence the fix actually held — not just that a ticket closed.
Exploit windows collapsed
Time to first exploit fell from 63 days in 2018 to 5 days in 2023, and went negative in 2024 — exploitation now lands before patches ship. A regression you find next quarter is a regression an attacker found last week.
The orchestration market just consolidated
April 2025: the leading scanner-agnostic orchestration platform was acquired by a scanner vendor. Thousands of customers are now shopping for a neutral alternative — one that isn't trying to sell them more scans.
Priced to undercut the legacy stack
Annual plans, no per-scanner add-ons, no surprise asset overages. Continuous Fix Verification is included on every tier — including Starter.
Starter
For small teams running their first real vuln program.
- Up to 500 assets, 5 users
- 5 scanner integrations
- Cloud SaaS deployment
- Continuous Fix Verification
- Compliance reports — ISO 27001, PCI DSS, HIPAA
- Email support
Team
For active security teams and growing service providers.
- Up to 2,500 assets, 25 users
- Unlimited scanner integrations
- Cloud SaaS or on-prem
- Multi-tenant for MSSP workflows
- AI Copilot and ROI dashboards
- API access and full integration suite
- Priority support
Enterprise
For critical infrastructure, regulated finance, and large MSSPs.
- Unlimited assets and users
- Air-gapped / on-prem deployment
- Dedicated Customer Success Manager
- Custom integrations and connectors
- SOC 2 attestation, SSO/RBAC
- 99.9% SLA guarantee
Questions, answered
01How does Continuous Fix Verification actually work?+
When a finding is marked resolved, vmp.one schedules automated re-tests using the same scanner, payload, and check that originally surfaced it. You set the cadence — daily, weekly, or after every CI/CD deploy. If the check fails, the finding re-opens itself, the original assignee gets paged, and the regression is recorded in the audit log with a timestamp. No human in the loop unless something fails.
02How is vmp.one different from a scanner?+
Scanners surface findings. vmp.one consolidates findings from many scanners, prioritizes them with risk context, routes them into your remediation workflow, and — uniquely — automatically verifies that the fix held weeks and months later. We are scanner-agnostic by design: we will never sell you a scan.
03Can we self-host or run air-gapped?+
Yes. vmp.one ships as Docker services and runs on a single server, your Kubernetes cluster, or fully air-gapped environments — available on Team (on-prem) and Enterprise (air-gapped) tiers. Cloud SaaS is the default. Many critical-infrastructure prospects and government customers run on-prem; we built for both from day one.
04How does authentication work?+
Keycloak is built in, with SSO via OIDC. Roles and tenants map cleanly onto your existing identity provider. SAML federation is on the near-term roadmap for enterprise customers.
05Do you have a free trial?+
Starter includes a free 6-month pilot. We onboard your environment, hand you a working setup, and only convert to paid when you say so. Team and Enterprise pilots are scoped during the demo.
06Which scanners and ticketing tools do you integrate with?+
Out of the box: Nessus, Qualys, OpenVAS, Burp Suite, Nuclei, Trivy, Snyk on the scanner side. Jira, ServiceNow, GitHub, GitLab, and Linear for ticketing. Slack, Teams, email, and webhooks for alerts. Splunk, Trellix, Elastic, and Sentinel for SIEM. Custom connectors typically ship in 1–2 weeks on request.
Find out which of your "fixed" findings aren't.
30 minutes. We connect to one scanner you already run, replay the last quarter of resolved findings, and show you what re-verification surfaces. No commitment.
- 30-minute live walkthrough on your data
- Pricing scoped to your environment
- Free 6-month pilot on Starter