The agent already knows your packages. We build a CycloneDX SBOM, run it through Trivy on our side, surface vulnerable packages with severity and KEV-overlay. No agent-side scanner, no full DB on your hosts.
A scanner that returns everything returns nothing you can act on.
The agent knows every dpkg, rpm and apk on the host. Scanning reuses that — no second agent, and no 500 MB vulnerability database sitting on each of your servers.
A critical CVE nobody is exploiting can wait for the next patch window. A medium one in CISA's Known Exploited catalog cannot. We overlay KEV so the difference is visible at a glance.
"41 findings" tells you nothing. "41, down from 58 last week" tells you the direction — and the posture score weights a critical twenty times heavier than a low.
Where the CVE has a known fixed version, the finding carries it. The answer is a package upgrade, not an afternoon of research.
Packages and container images are already catalogued, so scanning does not start with a discovery pass.
NVD metadata for severity, the CISA KEV overlay for what is actually being exploited. Severity is not urgency.
Where a fixed version exists, the remediation is a version-bump PR per service rather than a row in a report.
Vulnerability Scanning on every plan; daily cadence + real-time alerts from Pro.