Overview
Do you use BlueRock products to protect workloads? Learn about how BlueRock EVC can help you manage potential vulnerabilities in those workloads and quickly meet compliance requirements.
Last updated
Was this helpful?
Do you use BlueRock products to protect workloads? Learn about how BlueRock EVC can help you manage potential vulnerabilities in those workloads and quickly meet compliance requirements.
Last updated
Was this helpful?
As part of vulnerability mangement and compliance programs:
Security Operations teams have to quickly assess the technical nature of each CVE to determine which to patch first and when.
Vulnerability Management teams run prioritized patching campaigns to ensure all systems are protected by a set deadline.
CISOs and Heads of Security constantly reassess which of their security products can mitigate entire categories of vulnerabilities.
Security Compliance teams must routinely provide evidence to auditors proving the effectiveness of each compensating control deployed, in order to meet specific compliance requirements/frameworks.
BlueRock's Evidence of Vulnerability Coverage (EVC) is a generative, mixture of experts AI system that:
Focuses on which CVEs are relevant for Linux-based server or container workloads
Then determines if BlueRock can neutralize each matching CVE and act as a compensating control
And transparently explains how each CVE may be neutralized by which BlueRock mechanisms
Get Fast Answers: When a new zero-day CVE is discovered in the wild with active exploitation, the last thing a security operator wants to do is call or email their vendors asking: “Does your product block it?”. Or, wait 48 hours to 2 weeks for the vendor to blog about it. With BlueRock EVC, operators get answers fast — in 24 hours or less.
Get Detailed Explanations: Operators need to quickly understand how the CVE is mitigated. Are there additional settings you need to change in the product for this to work? What are the gaps or assumptions made by the vendor? With BlueRock EVC, operators get an automatic clinical, transparent analysis of what the CVE is, what assumptions were made about it, and how BlueRock mechanisms neutralize it.
Get The Whole Story: It’s usually never just about one CVE. Frequently, attackers use a chain of related CVEs to compromise victims. Attention is usually on the one CVE with the highest severity, but that doesn’t mean the others aren’t important. Operators are lucky to get their vendors to cover that one CVE at best. With BlueRock EVC, operators can validate each and every CVE clinically to best understand how BlueRock can be used to neutralize their effects.
