Exposures

The new Exposures view provides a CVE-centric inventory of vulnerabilities identified across connected sources. Exposures include key prioritisation context such as Vulnerability Risk Rating, impacted assets, last discovered date, exploit information, tags, and source attribution.

Exposures visibility is based on the applied Device Scope. You can view only exposures from devices configured as part of the Device Scope, and you must also be a member of the scope. All other device's exposures in your organization are not displayed. For more information, see Scopes.

By combining vulnerability intelligence with exposure and asset context, Remediation Insights helps security teams focus on the vulnerabilities that present the highest risk to the organization rather than relying on CVSS alone.

The following details are captured and displayed in Remediation Insights > Exposures.

• Exposure (CVE): This column lists the CVE identifier for each detected vulnerability. Select a CVE to open the detailed exposure profile, where you can review vulnerability information, associated threats, available fixes, and impacted assets. Use this column to identify, track, and investigate specific vulnerabilities across your environment.

• Vulnerability Risk Rating: The VRR score indicates the risk level of the exposure. Higher scores represent higher risk and help you prioritize vulnerabilities for remediation. For more information, see What is Vulnerability Risk Rating.

• Impacted assets: Displays all exposures or set a custom range based on the number of affected assets.

• Predictive Compliance: Indicates remediation readiness based on discovery, agent, and patch policy coverage. For more information, see Predictive Compliance.

• Last discovered: Displays when the system last detected the exposure to help you prioritize recent vulnerabilities. Filter the list by predefined time ranges (3, 14, 30, or 365 days) or a custom date range.

• Source(s): Displays exposures by source, such as Ivanti, Microsoft Defender for Endpoint, or Qualys.

• Exploits: Displays the list of exposures by exploit type, such as DoS, Privilege escalation, Remote Code Execution (RCE), Web apps, or those with no known exploits.

• Tags: Displays the exposures with specific tags, such as operating systems, platforms, or your organization’s custom labels. You can apply multiple filters at the same time. To clear a specific filter, deselect the filter in the drop down or select No filter applied to clear all filters.

Export the Exposures List

You can bulk export the selected exposures list to a text (.csv) file. To export, select the required exposures from the list and click Export.
The exported .csv file will include any column filters you have applied.

Filter the Exposures List

You can quickly narrow and prioritize exposures by applying filters to the columns in the Exposures list. Filters help you customize your view and focus on the most relevant data.

To apply a filter:

1. Select the Filter icon next to the column you want to filter.

2. Choose your filter options from the available selections or specify a custom range.

3. Select OK to apply the filter.

The filter options include:

VRR (Vulnerability Risk Rating):

• Filter by risk levels: None, Low, Medium, High, or Critical.

• You can also set a custom range to display specific VRR scores.

Exposure Actions

Actions let you add tags and run remediation-oriented exposure workflows in bulk for the selected exposures. Remediation Insights now enables you to take remediation-oriented actions directly from exposure workflows. You can add selected exposures to a patch group, bridging the gap between vulnerability prioritization and patch execution. This reduces manual hand-offs between security and IT teams and helps convert prioritized exposure data into actionable patching workflows inside Ivanti Neurons.

Ensure that you have Create & Modify Patch Configurations and Deploy Patch Configurations permissions. (Ivanti Neurons > Admin > Access Control > Roles > Permissions > Patch Management > Patch Settings > General)
For more information, refer to Access Control.

You can perform the following bulk actions on the selected Exposures:

• Add / remove tag:

  Use this option to add new tags or remove existing tags attached to the selected exposures.

  To add tags:

  1. Select one or more exposures (up to the supported limit of 100 exposures), and then go to Actions > Add / remove tag.

  2. On the Apply tags pop-up, click the search bar to select existing tags or create a tag by typing a new tag name and pressing Enter.

  3. Click Apply tags.
     The tags are linked to the exposures and are visible in the Exposures page. In the exposure details page, you can view user-defined tags and system-defined tags separately.

• Add to patch group:

  Use this option to add the selected exposures to the patch group.

  To add exposure to the patch groups:

  1. Select one or more exposures, and then go to Actions > Add to patch group.

  2. From the patch group list, select a group from the list or use the search box to find a group.

  3. Click Apply.
     The Add to Patch Group pop-up appears. This pop-up will appear only if the Deploy Patch Group permission is enabled.

  4. On the Add to Patch Group pop-up, you can select any of the following based on your requirements:

     • Save: Click to add the selected patches to the patch group.

       If the patch group has an associated patch configuration, a new configuration version is created and remains inactive. When you activate the configurations, the updated Patch Groups are included.

     • Save and make active: Click to save the selected patch and make the patch configuration active for the patch group.

       If the patch group has an associated patch configuration, the system creates a new configuration version and updates any Draft configurations to Active. These configurations will be deployed to all associated devices.

     • Cancel: Click to cancel the process.

     Once the patch group is updated, a success message appears.

• Create new patch group: Click to create a new private or public patch group. This gives you more control over asset ownership in Ivanti Neurons.

  To add exposures to a new patch group:

  1. Select one or more exposures, then go to Actions > Create a new Patch Group.
     The Create new patch group pane appears.

  2. Enter a patch group name in the Patch group name field.

  3. Click Apply to save the changes.
     Once the patch group is created, a success message appears.

Vulnerability Risk Rating

Vulnerability Risk Rating (VRR) considers industry-standard Common Vulnerability Scoring System (CVSS), Common Weakness Enumeration (CWE) data, OWASP (Open Web Application Security Project), open-source threat intelligence, subject matter expertise, trending information, and more. VRR represents the risk posed by a given vulnerability, provided as a numerical score between 0 and 10, to an organization or business. The higher the risk, the higher the VRR.

Use of Vulnerability Risk Ratings (VRR) in Vulnerability Management

To streamline and prioritize remediation efforts across our environment, we leverage Vulnerability Risk Ratings (VRR) as provided by the Ivanti platform. VRR is a numeric value ranging from 0.0 (lowest risk) to 10.0 (highest risk), reflecting the potential impact and exploitability of each vulnerability identified. The VRR is a dynamic rating based on various risk factors, including threat intelligence and vulnerability characteristics.

Within the platform, VRR values are prominently displayed in dashboards, asset inventories, and vulnerability reports. These ratings allow staff to efficiently sort and filter vulnerabilities, focusing attention and resources on the exposures that pose the highest risk to our assets and operations.

By incorporating VRR into our vulnerability management workflow, we ensure that critical issues are addressed promptly and risk is effectively reduced.

Predictive Compliance

Predictive Compliance is a leading indicator of remediation readiness for each exposure. The score helps teams understand whether impacted assets meet the required conditions for successful remediation, including Ivanti Neurons discovery detection, active Ivanti agent coverage, and an agent policy capability with an active patch configuration.

This helps security and IT teams identify remediation blockers earlier, such as assets that are not managed, do not have an active agent, or are not covered by patch capability. Teams can use this information to improve patch readiness before remediation deadlines are missed.

Compliance Criteria

For an impacted asset to be counted as compliant toward a CVE's score, it must satisfy all of the following criteria:

• Discovered: The asset is discovered by Ivanti Neurons (via either active or passive discovery).

• Active Agent: The asset has an Ivanti agent installed and is active.

• Patch Policy: The asset's assigned Neurons Policy includes an active Patch configuration.

If an asset is missing data for any of the criteria listed above, it is automatically treated as non-compliant.

How the Score is Calculated

The Predictive Compliance Score is displayed as a percentage in the Predictive Compliance column for each CVE. The score represents the ratio of compliant impacted assets to the total number of impacted assets for that specific CVE.

Example:

Consider a vulnerability that impacts 10 assets in your environment:

• Each asset accounts for an equal weight of 10% toward the overall score.

• If only 1 asset meets all three compliance criteria (discovered, active agent, and assigned a patch policy), the Predictive Compliance Score for that CVE will display as 10%.