Software inventory and vendors

Every scan observes software: a CMS from its meta tags, a framework from its markup, a server from its headers, a library from a script path, a version from any of those. The inventory is what all of that adds up to, and it is what the KEV and CVE feeds are matched against. It shares one page with the software you chose to watch (the watchlist): every application, where it runs, its version and its status.

Where

Web: Software in the rail. Your software is the one list (filters: Needs a look, All, Watched, Found, not watched). Runs on names the hosts, subdomains included, with a host where an advisory is confirmed first and in red. Click an application for every host it runs on with the version each one runs and how many advisories affect it, its open advisories and its published advisory history. Scan readings lists each detection with its evidence, and anything dismissed with Restore. Service status is the vendor rollup. Advisory feed is the whole CISA KEV and NVD feed.
iOS: Monitoring, Software (below the domain list) for the same list and application pages; under it, More, Service status for the vendors. For one domain, its Vulnerabilities module, Software & services.
API/MCP: GET /api/vulnapps/software (the Software page itself: watched and detected in one list, tool get_software_overview), GET /api/vuln-scan/components (portfolio), GET /api/vuln-scan/vendors, /vendors/:vendor; tools get_observed_components, list_software_vendors, get_software_vendor.

Every host, not only the domain

Readings are kept per host, so WordPress 7.0.5 on www and WordPress 6.8.3 on a forgotten staging. subdomain are two rows, not one. A host that stopped answering keeps its last reading and says how old it is ("not answering, last read 9 days ago"); it is never shown as clean. Each host also lists on the domain's own page, under Hosts and software.

Checkable versus seen

Software that exposed a version leads, because a version is what lets it be compared to a published advisory. Everything else (a CDN, an analytics tag, a font service, a framework with no version) is grouped by what it is, collapsed, and never counted as checked: an unknown version is unknown, not clear.

Each reading

On the web these are under Software, Scan readings.

Field	Meaning
Confidence	High, medium or low, from how the detector saw it (a generator tag is high; a filename pattern is low)
Detector	Which check read it: the technology fingerprint, a Nuclei template, Trivy, the header parser
Host	Which host it was on
Last seen	The newest scan that observed it

Reconciliation

The inventory is reconciled on every scan rather than appended to: a component that a scan of the same host no longer sees is retired from the current inventory (it stays in history), so a site that moved off WordPress stops carrying WordPress advisories. The scanner's own egress is discounted, so a fetch that passed through Cloudflare does not put Cloudflare on every site.

Name matching

Advisories are matched to products by canonical name, not by token overlap. "WP Engine" no longer matches Exchange CVEs on the word "Exchange". Where a component has no version, a matching advisory is labelled a name match and shown under Watching, never as a finding.

Vendors

Software, Service status on the web; Monitoring, Software, More, Service status in the app (also Account, Service status). The same evidence rolled up by company: every vendor the portfolio runs on, with component counts and open advisories, and how much of the portfolio the list rests on. A vendor with a status page shows its live status; one without shows "CVEs and KEVs only" and opens its advisory history.

Common questions

The inventory says my site runs software it does not. Open the reading: the detector and the evidence say what was seen. A theme that ships another CMS's assets is the usual cause. Dismiss the reading as a false positive and it stays dismissed across re-scans; Software, Scan readings lists it with Restore.

Where did Security, Software and Security, Vendors go? They moved to the Software page on 2026-09-23 (Your software and Service status). Old links redirect.

Why does the inventory look short? Most often because some domains have never been verified, so a scheduled scan does not run there and only basic scans read them; or only Quick scans have run, which read just the passive fingerprint. The Software page names domains that have never been verified. See Verifying a domain for deep scans.