Vulnerability Management

Moraph resells, implements and runs Tenable for banks, credit unions and other financial institutions. Tenable scans your network, servers and endpoints on the schedule you set, using credentials so it sees missing patches and weak configurations rather than only open ports. Moraph keeps the scans healthy, triages the findings, routes them to the teams that fix them and reports progress, while your institution decides risk acceptances and remediation priorities.

The problem it solves

Most institutions own a scanner, but scans quietly fail when credentials expire, new subnets go unscanned, and reports with thousands of findings are emailed to teams who cannot tell which matter. Remediation is tracked in spreadsheets, accepted risks are never revisited, and when examiners or auditors ask how often the network is scanned and how quickly critical findings are fixed, the evidence has to be rebuilt by hand.

Who it’s for

• Banks, credit unions and other financial institutions without a dedicated vulnerability team
• Information security officers who answer for the vulnerability management program
• IT infrastructure and server teams who apply the fixes
• IT risk and compliance staff who prepare evidence for examiners
• Internal audit reviewing scanning coverage and remediation

1. DiscoverTenable discovers assets across the networks you put in scope, and Moraph reconciles what it finds with your asset inventory so nothing is left unscanned.
2. ScanAuthenticated scans run on the schedule you approve, such as weekly, and Moraph checks every run for failed credentials and coverage gaps.
3. TriageMoraph reviews new findings, removes duplicates and known false positives, sets priority using severity, Tenable's priority rating and asset importance, and routes each to an owner.
4. Remediate and verifyYour teams apply fixes, Moraph rescans to verify them, and findings that cannot be fixed go through a risk acceptance your security officer approves.

Authenticated scanning

Tenable logs in to Windows, Linux and network devices with credentials you provide, so it reports missing patches and configuration weaknesses.

Agent-based scanning

Tenable agents on laptops and servers report vulnerabilities from devices that are often off the network during scheduled scans.

Scan health checks

Moraph checks each scan run for credential failures, timeouts and hosts that did not respond, and fixes them before the next run.

Asset discovery and reconciliation

Assets Tenable finds are compared with your inventory, and anything unknown or unscanned is raised for a decision.

Risk-based prioritization

Findings are ranked using CVSS severity, Tenable's Vulnerability Priority Rating and the importance of the asset to your institution.

Configuration audits

Tenable checks systems against configuration benchmarks such as the CIS Benchmarks you choose to adopt.

Remediation routing

Findings are grouped by fix and sent as tickets to the team that owns the asset, in your service management tool.

Fix verification

Moraph rescans fixed assets and closes findings only when Tenable confirms the vulnerability is gone.

Risk acceptance register

Findings that cannot be fixed are recorded with the reason, compensating controls, approver and expiry date.

Remediation targets

Target fix times by severity, set by your institution, with overdue findings escalated.

External exposure scanning

Internet-facing addresses you own are scanned from outside your network to show what an attacker could reach.

Executive and exam reporting

Coverage, open findings by age and severity, and remediation trends, prepared for management, the board and examiners.

Security officer

Owns the program, sets remediation targets and approves risk acceptances

Remediation owner

Fixes findings on the systems their team owns

Service owner

Manages the service with Moraph and approves scope and scan changes

Moraph vulnerability analyst

Runs scans, checks their health, triages findings and verifies fixes

Auditor or examiner (read-only)

Views coverage, findings, remediation and acceptances

Executive viewer

Sees summary reporting for management and the board

Asset inventory

Your configuration management database or asset list is compared with what Tenable discovers.

IT service management

Remediation tickets are created and updated in your service desk tool, grouped by fix and assigned to the owning team.

Privileged access vault

Scan credentials can be retrieved from your privileged access management tool, such as Moraph's managed Privileged Access Management service, rather than stored in Tenable.

Patch management

Findings are matched to the patches your patch management tool deploys, so verification follows each patch cycle.

Security monitoring

Vulnerability data forwarded to your SIEM or security operations provider to add context to alerts.

Cloud accounts

Cloud environments in scope are connected so cloud workloads are discovered and assessed.

Single sign-on

Your staff and Moraph analysts sign in through your identity provider where Tenable supports it.

Single sign-on

Users sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Remediation owners see their own assets; approving a risk acceptance is separate from requesting one.

Scan credential handling

Scan accounts are least-privilege and can be held in your privileged access vault; Moraph staff do not keep copies.

Encryption and keys

Scan data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Changes to scope, schedules, findings and acceptances are logged with the person and time, and cannot be edited.

Data residency

Scan data is held in the region you choose where the platform offers it: the United States, the United Kingdom or Australia.

Tenable cloud

Tenable Vulnerability Management hosted by Tenable, with scanners and agents in your environment, operated by Moraph.

Tenable on-premises

Tenable Security Center installed in your environment for institutions whose policies keep scan data on-premises, operated by Moraph under logged administrative access.

Existing Tenable deployment

Where you already own Tenable, Moraph reviews it against an agreed baseline and takes over operation.

Scope and inventory

We agree the networks, sites, cloud accounts and asset groups in scope and reconcile them with your inventory. We need network diagrams and an inventory export.

Licensing and deployment

Moraph supplies Tenable licences as a reseller or works with licences you own, and deploys scanners and agents where they are needed.

Credentials

Least-privilege scan accounts are created by your administrators and stored in Tenable or your privileged access vault.

Policies and schedules

Scan policies, schedules and windows are set for each asset group and approved by your service owner.

Ownership and targets

Asset owners are mapped to teams, remediation targets set by your security officer, and ticket routing connected to your service desk.

Baseline and handover

A first full scan establishes the baseline, findings are reviewed with you, and the monthly service review begins.

• Moraph is not Tenable. The platform belongs to Tenable, and Tenable's own service commitments, roadmap and outages apply to it.
• Licences are subject to Tenable's terms, including how assets are counted.
• Scanning finds vulnerabilities; it does not fix them. Your teams apply patches and configuration changes unless a separate Moraph service covers that.
• Results depend on the scan credentials and network access you provide. Assets that cannot be reached or logged into are reported as coverage gaps.
• A scanner only finds vulnerabilities it has checks for. Custom applications need application security testing, which is not part of this service.
• Scanning is not penetration testing. Where your regulations call for penetration tests, they are arranged separately.
• Running a scanner does not by itself satisfy GLBA or any other requirement; your institution decides scope, frequency and remediation targets under its own program.
• Remediation targets and risk acceptances are your institution's decisions; Moraph records and reports them.

• Compare your asset inventory with what a discovery scan finds
• Check how many hosts your current scans actually log into
• Review a sample triage: are findings grouped by fix and routed to the right team?
• Walk through a risk acceptance from request to approval and expiry
• Ask for a sample program summary and monthly service review
• Confirm in the responsibilities table which tasks stay with your teams