> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/vulnerability-management.md).

# Vulnerability Management

The agent collects the software installed on each host — operating-system packages and application dependencies. The platform automatically matches that inventory against its CVE database, so vulnerable software surfaces without you running a separate scan.

## Findings by severity

Each finding links an installed package to a known CVE and carries the CVE's severity (for example Critical, High, Medium or Low). Use severity to prioritise — Critical and High findings on exposed hosts first.

## Fleet view — the Vulnerabilities page

The **Vulnerabilities** page shows findings across your whole fleet. Use it to:

* See which CVEs affect your environment and how widespread each one is.
* Sort and filter by severity to focus on what matters most.
* Pivot from a finding to the affected hosts.

## Per-endpoint view — the Vulnerabilities tab

Open a host under **XDR → Endpoints** and select the **Vulnerabilities** tab to see only that host's findings. Filters let you narrow the list — for example by severity — so you can assess a single machine quickly.

## Workflow

1. Review the fleet **Vulnerabilities** page and filter to the highest severities.
2. Identify the affected hosts and confirm the vulnerable package on each host's **Vulnerabilities** tab.
3. Remediate — patch or upgrade the affected software.
4. As the agent reports the updated inventory, resolved findings drop off on the next scan.