A small continuous-exposure pipeline that turns raw scanner output into an asset inventory, a vulnerability lifecycle, and exposure KPIs.
Vulnerability management is less about running a scan than about what happens after it:
reconciling what is actually on the network, separating real findings from noise, confirming
that fixes really landed, and reporting exposure in numbers a program can act on.
exposure-tracker runs that whole loop on top of open-source scanners (OpenVAS, Nmap, and
Nessus exports), so the full CTEM cycle, discover, assess, validate, re-scan, report, works
end to end without a commercial platform.
Scope note: a reference tool, run against my own lab. The workflow is the same one enterprise VM platforms (Tenable, Qualys, Rapid7) automate; only the scanner console differs. It proves the methodology and the open-source tooling, not hands-on time with those commercial suites. It parses scanner output you already have; it never scans, probes, or touches a target host.
flowchart LR
S[OpenVAS / Nmap / Nessus export] --> I[Ingest + normalize]
I --> A[Asset inventory\ndedupe, IT / OT / IoT]
A --> V[Vulnerability store\nlifecycle + CVSS]
V --> R[Re-scan verifier\nconfirm / reopen]
A --> C[Coverage check]
R --> K[KPIs + dashboard]
C --> K
- Ingest. Parses OpenVAS XML, Nmap XML, and Nessus
.nessusexports into one common schema, so mixed-scanner output lands in a single model. - Asset inventory. Deduplicates hosts across scans (by IP, MAC, and hostname), classifies IT versus IoT/OT from open ports and service fingerprints, and flags newly seen assets and networks.
- Coverage. Compares discovered assets against scanned assets and surfaces gaps in scan coverage, the assets a scan silently missed.
- Vulnerability lifecycle. Keys each finding to an asset plus CVE or plugin ID and moves it through states: new, open, remediated (confirmed absent on a later scan), or reopened.
- Prioritization. Ranks by CVSS and highlights attack-surface exposure (internet-facing or high-value assets first).
- Re-scan verification. Diffs two scans to confirm remediation or catch regressions, the "validate the fix" step that closes the loop.
- KPIs and dashboard. Assets by type, findings by severity, scan coverage percentage, mean time to remediate, and open exposure over time, rendered as a dashboard.
A finding missing from the latest scan is not automatically fixed. It is only remediated if the later scan actually covered that asset with that scanner. Absence from a scan whose target spec never included the host proves nothing, and treating it as a fix is how a vulnerability management programme quietly loses track of real exposure.
So the lifecycle only transitions a finding to remediated when it can point at a later scan
that covered the same asset with the same scanner and did not report it. Everything else stays
open, and the coverage report surfaces the assets a scan silently skipped.
What the pipeline computes and the properties it is built to hold. These are the specified behaviours, not figures from a run; a lab run fills in the actual numbers.
| Metric | Target |
|---|---|
| Scanners ingested | OpenVAS XML, Nmap XML, Nessus .nessus, into one schema |
| Asset dedupe | MAC first, then IP, then hostname, in that order of confidence |
| IT vs IoT/OT split | Classified from open ports and service fingerprints, with confidence and evidence recorded |
| Scan coverage | Discovered minus assessed, reported as an explicit gap list rather than a bare percentage |
| Remediation | Only confirmed when a later scan covered the same asset with the same scanner |
| Reopened findings | Detected on return after a confirmed remediation |
| Prioritisation | CVSS, weighted by internet-facing and high-value assets |
| Mean time to remediate | Derived from state transitions in the finding history |
| Dashboard | Static HTML, no external CDN, renders offline |
- Ingest and normalize OpenVAS, Nmap, and Nessus output
- Asset inventory with dedupe and IT / OT / IoT classification
- Coverage-gap detection
- Vulnerability lifecycle with CVSS prioritization
- Re-scan verification (confirm / reopen)
- KPI dashboard
- Lab run measured against the targets above
Python 3, SQLite for the store, a static HTML dashboard.
exposure-tracker ingest results/openvas-2026-07.xml
exposure-tracker ingest results/nmap-discovery.xml
exposure-tracker verify --against results/openvas-2026-06.xml
exposure-tracker report --out dashboard/
MIT.