One portal for every engagement
The portal is where every scan session lands, gets tracked, and gets shared. Upload sessions from the CLI or your agents, watch risk trend down as remediation closes, cross-check installed software against the CVE database, and hand clients a report as a public link. One place for the whole engagement.
Every scan session lands here
Each finished session uploads to the portal, where a status strip above the dashboard shows session count, last scan date, risk grade, and critical and high finding counts at a glance. Below it, Sessions lists every upload, and more tabs appear as the client's data supports them: Trends charts Security Posture Trends (risk score over time, findings by severity, total findings, and hosts scanned), Remediation is a timeline to work findings to closure, Schedules groups the runs from your daemon's scheduled scans with a risk score by schedule chart, and Risk Register collects accepted risks and exceptions across sessions, exportable to CSV.
Open any session and it expands into the full picture:
- Notes and a Remediation view to work findings to closure.
- Compliance panels scored per framework.
- A network Topology map of what the scan discovered.
- An Ohio Revised Code 9.64 attestation for public-entity engagements.
Match installed software against the CVE database
A network scan sees what is on the wire. Inventory sees what is installed. The portal syncs software inventory from Syncro over its API, with an export upload as a fallback, and cross-references every application against known vulnerabilities, no packet required.
The portal connects to Syncro through its API: the site API key is encrypted at rest, and each portal client maps to a Syncro customer. Inventory syncs automatically each time a scan session is uploaded for that client, or on demand with a "Sync now" button; uploading a Syncro export still works as a fallback. The portal resolves every installed application and operating system to its NVD CPE, queries the CVE database, applies a version-range check, and records each match with its CVSS score, severity, and exact-or-fuzzy confidence. CVE matching runs in the background for large inventories. A CVE-weighted risk score (0 to 100) and its A-to-F grade sit in the report header, labeled "Risk". Results come back across seven tabs:
- Overview: six tiles, Systems, Software Installs, Unique Applications, Version Drift, Flagged Installs, and On Every Machine, plus an installs-per-machine chart.
- All Software: a per-application table with worst severity and links out to NVD.
- Matrix: an application-by-machine grid with severity-colored cells.
- Version Drift: the same application at different versions across machines.
- Security: NVD CVE matches, the top 10 with the rest expandable.
- Uncommon: software installed on only a few machines, the outliers worth a look.
- History: every sync or upload kept as a numbered version; compare any two to see software installed, removed, upgraded, or downgraded, and machines added or removed, with any snapshot exportable as CSV.
Overview also includes a managed-stack coverage grid showing, for each machine, whether the client's standard agents are installed or missing (by default Syncro, SentinelOne, Huntress, ScreenConnect, DefensX, and Tailscale; an admin can set the list per client). It is a fast way to spot a machine missing its EDR or remote-access agent.
It is agentless: no probe, no open port, no credentials to place. It covers the machines a network scan never touches, from the laptop that was closed during the sweep to the workstation on a segment you were not authorized to cross. The full report can also be exported as a standalone HTML file to hand to a client, and admins can brand it per client (name, logo, and a "Bottom line" summary note), which carries into the export.
The Matrix tab, with version drift highlighted.
The History tab, comparing two inventory versions.
The admin side runs the fleet console
The same portal that collects and shares your sessions also dispatches commands to them. Remote command dispatch to your agents ships from the Business tier: queue a scan, pull a session, or roll an update on any one agent you choose. On the MSP tier, the admin side becomes the full fleet console (Command & Control), dispatching across every scanner agent at once with agent groups and an audit log.
How it all connects
Sessions flow up from the CLI and your agents into Collect, then out as public share links. Inventory rides a separate input, Syncro, synced over its API or imported as an export, and never needs to touch the network.
What the portal does per tier
The portal is one product; your tier decides how much of it is on. The Open-source core runs entirely offline, so the portal starts at Pro.
| Capability | Pro | Business | MSP |
|---|---|---|---|
| Upload and download sessions | Yes | Yes | Yes |
| Read sessions and update status | Yes | Yes | Yes |
| Stored sessions | 100 | 750 | 3,000 |
| Agents | 3 | 15 | 40 |
| Peer benchmarking | No | Yes | Yes |
| Remediation tracking | No | Yes | Yes |
| Webhook subscriptions | No | Yes | Yes |
| Compliance panels | No | Yes | Yes |
| Command dispatch to individual agents | No | Yes | Yes |
| Fleet console and agent groups | No | No | Yes |
| Audit log and database health | No | No | Yes |
Access is by invitation; the portal has no self-serve signup. Your tier is provisioned when you buy, and it decides which panels light up.
Get every engagement into one portal
Collect your sessions, track remediation to closure, cross-check software against CVEs, and share client-ready reports, all from the netvuln-tool portal. Pick a tier and we will provision your access.