Vulnerability Management

Onam's Vulnerability engine scans every cloud workload — virtual machines, container images, serverless functions, and Kubernetes nodes — and correlates each CVE with the workload's actual runtime context (network exposure, exploitation activity in the wild, blast radius) to produce a prioritized list of what to patch first. Cloud-side scanning is agentless; optional host agents add OS-level depth on Linux, macOS, and Windows servers.

This page covers the scan pipeline, the four intelligence sources (NVD, EPSS, CISA KEV, OSV), the Effective Risk Score model, SBOM generation, the optional host agents, and the finding lifecycle.

Why Prioritization Is the Product

The NVD now publishes 25,000+ new CVEs per year, and a typical mid-size cloud estate carries thousands of open CVE findings at any time. CVSS alone is a poor predictor of exploitation — less than 5% of all CVEs are ever observed exploited in the wild. The engine's job is to surface that 5%, ranked by your exposure, ahead of the noise.

How It Works

Vulnerability management runs as a single end-to-end pipeline on every scan. Workloads are analyzed through your read-only cloud credential and the Agentless Scanner engine's snapshot scanning — no code runs inside your workloads.

Agentless-by-default matters: there is no fleet of scanners to upgrade, no agent compatibility matrix, and no high-value agent channel for attackers to target. Lambda functions, Fargate tasks, and ephemeral spot instances get scanned the same way as long-running instances — there is no "we couldn't install the agent" coverage gap.

Vulnerability Intelligence Sources

Four curated sources feed detection and prioritization:

Vendor advisories (Microsoft MSRC, Red Hat, GitHub Security Advisories) are also tracked — they often run ahead of NVD, so new zero-days typically appear within hours.

Supported Workload Types

For registries, every image in ECR, ACR, GCR, OCIR, Alibaba ACR, and IBM Cloud Container Registry is scanned — both pushed images and images currently deployed.

Risk Prioritization Model

Four input signals combine into a single Effective Risk Score from 0 to 100. Findings sort by this score by default.

Worked example — three CVEs ranked:

The middle row is the lesson: CVE-2024-0002 has the lowest CVSS of the three, but it is actively exploited (KEV), highly likely to be exploited again (EPSS 85%), and lives on an internet-facing workload — so it ranks first. CVSS alone would have ordered these wrong. Adjust the per-signal weights in Settings → Vulnerability → Risk Model if your environment needs different priorities.

SBOM Generation

Onam generates Software Bills of Materials for every scanned workload in CycloneDX (OWASP; used by GitHub and FedRAMP) and SPDX (Linux Foundation; required by US EO 14028). SBOMs are required for FedRAMP, the EU Cyber Resilience Act, and most supply-chain audit programs — and they answer "which of my workloads have log4j on them" instantly during the next supply-chain incident.

Two SBOM engines run in the platform: the infrastructure SBOM engine described here (workloads, images, snapshots) and the SecOps SCA engine that builds SBOMs from repository dependency manifests at PR time — see IaC Scanning & SecOps. Both export the same formats, so evidence pipelines consume one schema.

GET /api/v1/vulnerability/sbom?resource_uid={uid}&format=cyclonedx

SBOMs auto-update on every scan and can be delivered via webhook on update — useful for compliance evidence pipelines that retain SBOM history.

Optional Host Agents

For servers where you want OS-level depth beyond what snapshot scanning sees, Onam ships an optional host agent (onam-agent) for Linux, macOS, and Windows. The agent is a server-side vulnerability scanner that discovers installed system components and reports to the central Vulnerability engine, with a hybrid mode that performs analysis locally before reporting.

• Discovers OS packages, kernels, and installed software on the host itself
• Reports component inventory to the central engine for CVE matching and scoring
• Hybrid mode: local analysis on the host, centralized prioritization and reporting
• Useful for hosts outside the cloud accounts (on-prem, colo) and the Technology Engine's self-hosted estate

Agents are never required for cloud posture. The cloud connection itself stays agentless and read-only — agents only add OS-level vulnerability depth on hosts where you choose to install them.

DAST

A DAST scanner is included in the platform via the SecOps engine — runtime testing of HTTP APIs and web applications against the OWASP API Top 10, complementing the configuration- and package-based analysis on this page. Setup and payload details are in IaC Scanning & SecOps.

Finding Lifecycle

Every finding moves through defined states, and each transition is logged in the audit trail. Closures are verified by the next scan, not by an analyst self-reporting "fixed".

Auto-closure prevents "ghost findings" — patches applied months ago whose findings never closed because nobody clicked a button. Suppressions require a justification, optionally an expiry and an approver; on expiry the suppression auto-reverts to Open, so risk acceptance never silently becomes permanent.

Key Metrics to Track

API

# List vulnerability findings, sorted by effective risk score
GET /api/v1/vulnerability/findings?sort=risk_score&order=desc&status=OPEN

# Aggregate statistics by severity, KEV, and exposure
GET /api/v1/vulnerability/findings/stats

# Get the SBOM for a specific resource
GET /api/v1/vulnerability/sbom?resource_uid={uid}&format=cyclonedx

Webhook delivery on new Critical findings (Effective Score at or above 90, or KEV match) can be configured in Settings → Notifications.

FAQ

Does Onam scan workloads while they're running? Yes — agentlessly. The Agentless Scanner engine reads workload metadata, manifests, and attached snapshots through your cloud API to enumerate installed packages. No code runs inside your workload unless you opt into the host agent.

When should I install the host agent? When you need OS-level component discovery beyond snapshot analysis — long-lived servers, hosts outside your cloud accounts, or fleets where local (hybrid) analysis is preferred. For most cloud estates, agentless coverage is sufficient.

Does Onam support custom CVE feeds? Yes — on Enterprise plans you can ingest your organization's internal advisory feed; it merges with NVD, OSV, and vendor data in scoring.

Can I customize the Effective Risk Score formula? Yes. Settings → Vulnerability → Risk Model exposes per-signal weights (CVSS, EPSS, KEV, exposure) and severity range overrides.

Does Onam support container layer attribution? Yes. When a CVE is detected in a container image, the finding identifies which layer introduced the vulnerable package — so you fix it once, at the Dockerfile or base image.

Next steps

• Container Security — image scanning in registries and clusters
• IaC Scanning & SecOps — catch vulnerable dependencies at PR time with SCA
• Risk Quantification — convert CVE exposure into dollar terms
• API reference — findings, stats, and SBOM endpoints