If your organization runs Cisco Vulnerability Management, formerly known as Kenna, the clock is running. Cisco has announced end of sale and end of life, the last date to renew or change a subscription has passed, and support ends in mid-2028. This page is for the team that now has to choose a Kenna security alternative and move without losing its risk model on the way. It covers the dates, what a replacement has to do, where SITEY fits and where it does not, and a step-by-step migration plan.
Kenna end of life: the dates that matter
Cisco’s end-of-sale and end-of-life notice covers Cisco Vulnerability Management, Cisco Vulnerability Intelligence and the Application Security Module, formerly Kenna.VM, Kenna.VI and AppSec. These are the milestones from that notice:
| Milestone | Date | What it means for you |
|---|---|---|
| End-of-life announcement | 10 December 2025 | The product line entered its retirement schedule. |
| End of sale | 10 March 2026 | The products can no longer be ordered. |
| Last date to renew or change a subscription | 11 June 2026 | Existing subscriptions can no longer be renewed or changed. |
| Last date of support | 30 June 2028 | Support for subscriptions ends. |
Cisco’s notice states “There is no replacement available” for these products at this time. Cisco does not name a successor, so each customer has to choose its own next platform.
Support until 2028 sounds like plenty of time. In practice, your deadline is the end of your current subscription term, and a clean migration with a parallel run takes longer than most teams plan for. Starting the evaluation now leaves room to compare results before you switch reporting.
What a Cisco Vulnerability Management alternative has to do
When teams write down what they need from a replacement, two jobs usually come first: bringing findings from several scanners into one deduplicated list, and ranking that list by real-world risk instead of raw CVSS. Here is how SITEY covers each, and what it adds after the ranking.
| What you need | SITEY | How it works |
|---|---|---|
| Findings from several scanners in one place | 16 scanner integrations | Imports results from the tools listed below. Launches Nessus and OpenVAS scans directly; the other tools connect by importing their reports. |
| One clean list | Collection and deduplication phase | Findings are normalized to one severity scale. A repeat finding from the same scanner raises a detection count on the original record instead of opening a new one. The same issue reported by different scanners is grouped as a duplicate during AI triage. |
| Risk-based prioritization | AI triage | A priority score and a false-positive probability for every finding, using CVSS, EPSS and CISA KEV. The reasoning is stored and an analyst can reverse the verdict. |
| Getting the fix done | Remediation pipeline | Host-specific scripts, an approval gate, agent execution and retest. Covered in the next section. |
SITEY imports scanner output; it is not a replacement scanner. You keep the scanners you already license and trust. The scanner integrations module explains the parsers, severity mapping and deduplication in detail.
Prioritization happens in AI triage. Every finding gets a priority score from 0 to 100, built from visible components, and a false-positive probability with the signals that produced it. Where a CVE is present, the record is enriched with the EPSS exploitation probability and a CISA KEV flag. The rule-based scoring layer runs without an AI key. The deeper AI analysis sends the finding text and host context to the OpenAI-compatible endpoint you configure, with your own key; you can point it at a model endpoint you host yourself, or switch AI off.
What SITEY adds after prioritization: from a ranked list to a verified fix
A ranked list is where many vulnerability programs stall. Someone still has to write the fix, get it approved, apply it and prove it worked. SITEY’s eight-phase pipeline (discovery and scanning, collection and deduplication, AI validation, risk scoring, assignment, AI remediation planning, approval-gated patching, retest and closure) is built to carry a finding through all of that.
SITEY installs on Ubuntu 22.04 or 24.04, Debian 12, RHEL or Rocky 9. Findings, assets and history are stored in your own PostgreSQL database, not in a vendor-hosted tenant.
For a confirmed finding, AI remediation planning writes a bash or PowerShell script for that specific host, using the OS and inventory its agent reports.
Four autonomy levels and 18 risk-classified AI actions. High-impact changes wait until a person approves the exact script for the exact host. See approval gates.
Agents on Windows and Linux endpoints run approved scripts and report the result and host inventory back to your server.
A successful script does not close the finding. It moves to retest, and closure follows the rescan.
A risk score tells you what to fix first. SITEY is built to carry that decision through to a verified fix, with a person approving every high-impact change.
If keeping findings on your own infrastructure is part of why you are moving, read the on-premise vulnerability management overview and the exact outbound connections on the security page.
Where SITEY is not the right Kenna replacement
A migration is expensive to reverse, so the limits come before the migration plan.
SITEY is not SaaS: you install and run it on your own Linux server, and there is no hosted version. Installing, updating and operating it needs a technical person who is comfortable with Linux, PostgreSQL and agent rollout. Each license has an IP quota, see the pricing page; very large estates may exceed it. SITEY is not air-gapped: license activation and validation and the engine feed need outbound HTTPS to siteyvm.com. AI features run through your own OpenAI-compatible endpoint and key, and AI usage cost is not included in the price. Integrations are the 16 scanner imports listed above, and there is no dedicated Kenna importer; if your current setup draws on sources outside that list, they will not come across.
How to migrate from Kenna to SITEY
- Archive what you must keep
While your Cisco subscription is still active, save copies of the records your auditors or your team will need later, such as risk acceptances, exceptions and closure history, in whatever form your current setup allows. SITEY does not import Kenna data, so treat this as an archive and as your reference for rebuilding decisions.
- Map your scanners
List every scanner that feeds your current program and check it against the 16 integrations. Nessus and OpenVAS can be driven directly from SITEY; the other tools connect through their report exports.
- Check the quota and size the server
Compare your estate with the IP quota on the pricing page before you buy. Then prepare a Linux server on a supported distribution with PostgreSQL.
- Install and connect your scanners
Buy online, run the installer and activate the license. Store the Nessus and OpenVAS connection details once, and upload current exports from your other tools. Repeat findings from the same scanner are counted on the original record, and the same issue reported by different scanners is grouped as a duplicate during AI triage.
- Deploy agents
Roll out the Windows and Linux agents with the deployment tooling you already use. Agents report inventory, which remediation planning uses to write scripts for each host.
- Compare prioritization
Run AI triage on the imported queue and compare the top of the list with your current risk ranking for one cycle. Where the two disagree, read the stored reasoning; an analyst can reverse any verdict.
- Turn on remediation behind the gate
Start with an autonomy level that stops for approval before anything changes on a host. Widen it only for classes of findings where you have watched the proposed fixes and agree with them.
- Run in parallel, then cut over
If your Cisco term allows it, run both for a scan cycle or two, then move reporting and assignment to SITEY.
What SITEY costs
Pricing is flat and self-service: you buy online, install it yourself, and there is no sales call. The monthly plan is $599 per month and can be canceled. The lifetime option is $5,999 once for a perpetual license, with one year of updates and engine feed included. There is no per-asset fee and no scan quota, but each license has an IP quota, see the pricing page. AI usage is billed by the provider you choose, not by SITEY. Full details are on the pricing page.
Who builds SITEY
SITEY is developed by SITEY Bilisim at Giresun Teknopark in Bulancak, Turkey. The founder has worked as a security researcher since 2014 and has published CVE-2021-40960 and CVE-2022-3792. The product is built for teams that want to run vulnerability management on their own infrastructure and close findings, not only rank them.
Frequently asked questions
Is Kenna still supported after end of sale?
According to Cisco’s end-of-life notice, the last date of support for subscriptions is 30 June 2028. The last date to renew or change a subscription was 11 June 2026, so a subscription can no longer be extended by renewal.
Can SITEY import my Kenna data directly?
No. SITEY has no dedicated Kenna importer. Archive the records you need from your current setup, then connect your scanners to SITEY and import their current results. Nessus and OpenVAS can be connected directly; the other 14 supported tools connect through their report exports.
Does SITEY work offline or in an air-gapped network?
No. SITEY makes two connections to siteyvm.com: license activation and validation, and the engine feed. Neither carries your scan data. Optional outbound calls go to the OpenAI-compatible AI endpoint you choose (it receives finding text and host context, and you can use an endpoint you host yourself or turn AI off), and to NVD, CISA KEV, FIRST EPSS, MSRC and the Microsoft Update Catalog. Findings are stored in your own PostgreSQL database.
Which scanners can I keep?
SITEY imports results from 16 tools: Nessus, Tenable, Qualys, OpenVAS, Nexpose, Nmap, Nuclei, Burp Suite, OWASP ZAP, Acunetix, AppScan, Arachni, Netsparker, Intruder, Fortify and MobSF. It launches scans directly only in Nessus and OpenVAS. Commercial scanners need their own licenses.
Will SITEY change my servers without approval?
You decide how far automation goes, using four autonomy levels. High-impact changes are held until a person approves the exact script for the exact host, and the decision is recorded. Read-only diagnostic scripts can run during analysis without a separate approval. After an approved fix runs, a retest checks the result before the finding is closed.
How does SITEY pricing work?
$599 per month, which you can cancel, or $5,999 for a lifetime license with one year of updates and engine feed. There is no per-asset fee and no scan quota, but each license has an IP quota, see the pricing page. AI usage cost is not included.
Sources
- Cisco, “End-of-Sale and End-of-Life Announcement for the Cisco Vulnerability Management, Vulnerability Intelligence, and Application Security Module (formerly known as Kenna.VM, Kenna.VI, and AppSec)”: https://www.cisco.com/c/en/us/products/collateral/security/vulnerability-management/vm-vi-appsec-eol.html, accessed 24 September 2026.
Cisco, Cisco Vulnerability Management and Kenna are trademarks or registered trademarks of Cisco Systems, Inc. and/or its affiliates. SITEY is not affiliated with or endorsed by Cisco. Nessus and Tenable are trademarks of Tenable, Inc. Other product names mentioned on this page are trademarks of their respective owners and are used only to identify compatible tools.