Dashboards, Reporting, and Vulnerability Prioritization
Dashboards
Dashboards are collections of components (matrices, charts, tables, vulnerability detail) driven by saved analysis filters: repository, asset list, severity, VPR, and time range. Each component refreshes on its own interval, so a dashboard can look stale without being wrong. Templates such as Vulnerability Management or Executive provide a starting layout; dashboards can be shared with an organization or kept private.
Reporting
Report definitions combine chapters (executive summary, vulnerability detail, compliance results) with filters and output formats (PDF, HTML, CSV, RTF). They run on demand or on a schedule and can be emailed or archived. The filter defines the answer: same data, different chapter selection, very different report.
Prioritization
Severity (Info through Critical) alone is a weak ranking. VPR (Vulnerability Priority Rating, 0.1 to 10) blends CVSS with threat and exploit intelligence, while ACR (Asset Criticality Rating) expresses how much the asset matters. Together they let teams work the highest-risk items first. Two governance mechanisms sit on top: recast rules change a vulnerability's severity inside a repository to reflect a compensating control, and acceptance rules record risk accepted for a defined period.
Traps
- Recast and acceptance rules are repository-scoped; applying them in the wrong repository changes nothing.
- Accepted risks still appear unless the report excludes them, and they expire.
- VPR is unavailable for plugins lacking VPR data, so rankings shift silently.
- Dashboards and reports only show data from the repositories and asset lists selected.
Rule of thumb: prioritize by VPR first, then narrow by ACR or asset list, and review accepted risks before they expire.