Home/Solutions/Vulnerability Detection

Capability · Vulnerability Detection

Know which hosts a CVE hits, without a scan.

A CVE drops, and the only question that matters is which of your servers are actually exposed. Suriq checks every host's installed packages against the CVE databases continuously, scores each finding by CVSS, and groups them by family - so the moment something lands, you see exactly where you are exposed and what to fix first.

The vulnerabilities view: detected CVEs per host with CVSS score, severity, affected package, fixed version, and family grouping. — Click to expand

The problem

A CVE drops. Now find every host it touches - by hand.

The advisory hits the news, and the scramble starts: which servers run the affected package, at which version, and which of those are actually reachable? Done by hand across a fleet, that answer takes days. The exposure is open the whole time.

The Suriq way

Continuous CVE scanning

Every host's installed packages are checked against the CVE databases on a managed Wazuh core, each finding scored by CVSS and grouped into families so the picture stays current, not quarterly.

Exposure without a scan

When a new CVE lands, see exactly which hosts run the affected package, ranked by severity - so your team patches the real exposure first, not a spreadsheet of maybes.

A fix, explained

The built-in assistant turns the CVE into a plain-English read and suggests the remediation. It advises; your team approves and acts. Guided and approval-gated, never a silent auto-patch.

Side-by-side

Legacy stack vs. Suriq

Dimension	Legacy	Suriq
Scan cadence	Manual or quarterly scans	Automatic, on a regular schedule
Exposure mapping	Manual cross-reference	Which hosts, in seconds
Prioritization	A CVSS dump	Ranked worst-first
Remediation	You research it	AI-explained, guided, approval-gated

Catch the misconfigurations attackers look for.

Every host scored continuously against security-hardening baselines, the risky settings ranked first, with guided, approval-gated fixes.

Capability

Know who is exposed, fast.

When a new CVE drops, Suriq tells you which hosts it hits - then correlates, alerts, and keeps a full audit trail through the recovery.

FAQ

Frequently asked questions

How does Suriq find which hosts a new CVE affects?

Suriq automatically checks every host's installed packages against the CVE databases on a managed Wazuh core. When a CVE lands, you see exactly which hosts run the affected package and version, each finding scored by CVSS, so you can act on the real exposure instead of cross-referencing by hand.

How does Suriq prioritize which vulnerabilities to fix first?

Every finding carries its CVSS score and severity, and related packages are folded into families so one kernel issue is not counted a dozen times. Findings are ranked worst-first across the fleet, so the highest-severity, most-exposed hosts surface at the top.

Does Suriq patch vulnerabilities automatically?

Not by default. Suriq's assistant turns each CVE into a plain-English read and proposes the package update, which waits for your team to approve it. Automatic approval of package fixes is an opt-in setting with limits you set.

Is Suriq an alternative to Tenable or Qualys vulnerability scanning?

Tenable and Qualys run vulnerability scanning as a standalone product you point at your fleet and export from. Suriq folds package-level CVE detection into one managed detection platform: every host's installed packages checked continuously against the CVE databases on the managed Wazuh core, scored by CVSS, grouped by family, and paired with an AI-explained, approval-gated fix - correlated with your other security signals, not a scanner off to one side.

Do I need to install an agent for vulnerability detection?

Package vulnerability scanning runs through the lightweight Guardian agent on the host, which reads the package inventory the system already tracks. Monitoring and cloud checks are agentless; the deeper endpoint capabilities, including this one, use the agent.

See what Suriq finds on your own servers.

Agentless checks for uptime and your cloud, a lightweight agent for detection on each server, and one console that ranks and explains what it finds.

Get Access How it works