Vulnerability management that prioritises real risk

Frequently asked questions

What is the difference between vulnerability management software and a vulnerability scanner?

A scanner produces a list of findings at one point in time. Vulnerability management is the process around it: continuous scanning, prioritisation by actual risk, assignment to owners, status tracking, retests and evidence for auditors. blacklens.io covers both. Scans run automatically, and every finding carries status, comments, history and prioritisation signals such as EPSS and CISA KEV.

How does blacklens.io prioritise vulnerabilities?

Alongside CVSS v3 and v4, the platform shows for every vulnerability the EPSS score (probability of exploitation in the next 30 days), whether the CVE is in the CISA KEV catalogue, whether public exploits or proofs of concept exist and whether a fixed version is available. If EPSS exceeds 0.80 and an exploit is available, the alert is escalated automatically. The AI remediation plan additionally ranks by risk reduction per action.

How often are scans run, and what happens to fixed vulnerabilities?

You set the scan interval per workspace; for individual findings you can start a retest at any time. Every finding carries a status: opened, in progress, snoozed, risk accepted or closed. If a vulnerability is no longer detected on the next scan, blacklens.io closes the finding automatically with a timestamp and archives it after 30 days. Snoozed findings reopen automatically after 30 days so nothing is forgotten.

Which reports can I generate?

Six PDF report types are available: an executive report for management, a vulnerability report for engineering, a pentest report, a query report from any BQL query, an insights report and a security snapshot. Reports can be sent to recipients daily, weekly or monthly. Every list can also be exported as CSV.

Where does my data go when I use the AI features?

Nowhere. The language model is self-hosted by blacklens.io in the EU; no external AI providers are used. AI features must be enabled explicitly per workspace and are enforced server-side. For every vulnerability, explainable AI provides a summary, suggested urgency, threat intelligence, root cause, impact, remediation and compensating controls, and you can ask follow-up questions in the chat. An analysis usually takes less than 30 seconds, a remediation plan less than a minute.

How does the AI remediation plan work?

The AI remediation plan is an automatically generated action list for the open findings in a workspace. The AI groups findings that can be fixed with the same action, such as one update that closes many findings at once, and ranks the groups by risk reduction and effort. A plan covers up to 120 groups, is usually ready in under a minute and shows progress live. The language model is self-hosted, without external AI providers.

Which systems does the vulnerability scan cover?

The blacklens.io vulnerability scan covers three layers. Internet-facing web applications, network devices and services are tested with a feed of more than 200,000 daily-updated tests. Cloud accounts at AWS, Azure, Microsoft 365, Google Cloud, Cloudflare and Hetzner are inventoried through connectors and audited with more than 500 CIS-aligned checks, weekly by default or on demand. Behind the firewall, the Sentry agent tests servers, clients, printers, cameras, industrial controllers and Active Directory.

What is BQL?

BQL stands for Blacklens Query Language. It lets you filter any list in the platform with operators for equals, contains, greater than, less than and similar to, combined with and, or and not, parentheses and wildcards. A visual query builder, autocomplete and the Ctrl or Cmd+K shortcut help you build queries; alternatively you describe what you are looking for in plain language and the platform translates it into BQL. Any query can be exported as a PDF report.