Platform Features: Autonomous Vulnerability Management

SITEY is an autonomous vulnerability management platform. Most tools in this category stop at the report. SITEY keeps going: it verifies the finding, decides whether it matters on your estate, writes the fix for that specific host, applies it under an approval gate, and re-tests to prove the issue is closed. Your defense is now autonomous.

This page describes what the platform actually does, phase by phase. If you are evaluating it against a scanner you already own, the relevant question is not “does it find CVEs”. It is “what happens after it finds them”.

The eight-phase pipeline

Every finding moves through the same eight phases. Each phase has its own state in the database, so you can always see where a vulnerability is and why it stopped there.

1. Discovery and scanning

Scans are scheduled per asset group or triggered on demand. SITEY drives the scanners you configure, network, web, container, code, mobile, and collects raw output. Discovery also runs independently of vulnerability scanning: new hosts, new ports and newly exposed services are recorded as assets even when nothing is flagged on them yet.

2. Collection and deduplication

Raw results from different engines are normalized into one finding model, then deduplicated across scanners, across scans and across time. The same missing patch reported by three tools under three different names becomes one record with three pieces of evidence attached. Re-scanning the same host does not create a second ticket; it updates the existing one and extends its history.

3. AI validation and triage

Each deduplicated finding is examined by the AI core before a human sees it. The model reads the scanner evidence, the asset context and the collected system state, then decides whether the finding is real, a false positive, or unverifiable with current data. Findings marked false positive are suppressed with a written justification, not silently dropped.

4. Risk scoring

CVSS is an input, not the answer. SITEY re-scores each validated finding against your environment: is the service actually reachable, is the asset internet-facing, does it carry data you have tagged as sensitive, is there known exploitation activity for that CVE. A critical CVSS score on an isolated internal host can rank below a medium on an exposed edge service, and the reasoning is stored with the score.

5. Smart assignment

The finding is routed to an owner. Assignment uses asset ownership, team mapping and finding type, so Linux package issues do not land in the application team’s queue. Each assignment carries a due date derived from the risk score, and SLA breaches are visible at the team level rather than buried in a per-asset view.

6. AI remediation plan

The AI core produces a concrete plan for that host: the exact package manager, service name, config path and command sequence for the operating system and version in front of it. Plans include the expected effect, the rollback step where one exists, and any service restart the change requires. A generic “upgrade to the latest version” is not an acceptable output and is rejected by the pipeline.

7. Automated patching

Approved plans are executed by the agent on the target host. Low-impact changes can run unattended within the windows you define. High-impact changes, anything that restarts a service, changes a firewall rule, touches accounts or alters policy, stop at a gate and wait for a human. The approval screen shows the finding, the model’s reasoning and the literal command that will run before you approve it.

8. Retest and closure

After the change lands, SITEY re-tests the specific finding rather than trusting the exit code of the patch command. Only a clean re-test closes the record. A failed re-test sends the finding back into triage with the failed attempt attached, so the next plan is written with knowledge of what already did not work. This is what turns the 72-hour target for critical findings into something you can audit rather than something you hope for.

The AI core

The AI is not a summarizer bolted onto a report. It is the component that makes decisions between phases, and it is designed to be inspectable.

False positives, suppressed with evidence

Triage decisions are stored in full: what the model looked at, what it concluded, and why. Nothing is truncated for display. You can filter for suppressed findings, read the reasoning, and reverse the decision. A suppression you cannot audit is just a deleted finding, which is why every one of them is reversible and attributed.

Environment-aware remediation

Remediation quality depends entirely on context. SITEY feeds the model the collected host state, distribution and version, installed package versions, running services, relevant configuration, before it writes anything. The output is verified against a rulebook of known-good remediation patterns, and plans that fail that check are regenerated instead of shipped.

Human-in-the-loop gates

Autonomy is configurable per asset group and per action class. You decide which categories run unattended and which stop for approval. Gates are enforced server-side, not in the interface, and every approval, rejection and automatic action is written to an audit trail with the actor, the timestamp and the payload.

Seventeen scanners, one worklist

SITEY ships with connectors for seventeen scanning engines. You keep the tools you already trust; SITEY becomes the layer where their output is reconciled.

Unification buys you three concrete things. First, deduplication: one finding per real problem, not one per tool. Second, a single prioritized worklist, so a team is not reconciling three consoles with three severity schemes by hand. Third, comparable coverage data. You can see which assets were last examined by which engine, and where the gaps are.

Agents and asset inventory

You roll out a lightweight agent to your hosts. The agent handles authenticated collection, reports installed package and configuration state, and executes approved remediation plans. Agentless scanning still works for anything you cannot or will not install on, but authenticated agent data is what makes precise remediation possible.

The inventory is built from discovery and agent check-ins together, so an asset that stops reporting is visible as a gap rather than quietly disappearing from your risk numbers. Assets carry ownership, environment, exposure and sensitivity tags, and those tags feed directly into risk scoring and assignment.

Twenty-three modules

The platform is organized into 23 modules across five groups:

• Discovery and inventory, Assets & Agents, Attack Surface, network and service discovery.
• Findings: scan management, the unified vulnerability register, triage and false-positive review, risk scoring.
• Remediation, Patch Management, remediation plans, approval gates, retest and verification.
• Program management, Team & Tasks, assignment rules, SLA tracking, audit trail, user and role administration.
• Output, AI Reporting, Compliance, dashboards, exports and integrations.

Reporting

Two audiences, two formats. Executive reports cover exposure trend, time-to-close, SLA performance and the current critical backlog in plain language. Technical reports go per-finding: evidence, affected assets, the remediation plan that was generated, what was executed, and the re-test result. Both are generated from the same data, so the number in the board pack and the number in the engineer’s queue cannot drift apart.

Compliance mapping

Findings and controls are mapped to ISO 27001, PCI DSS, SOC 2, GDPR, KVKK and BDDK, so you can answer “which of our open findings touch this control” without rebuilding the mapping in a spreadsheet each audit cycle. To be precise about what this is: SITEY maps your technical findings to those frameworks and produces the evidence trail. It does not make you compliant, and we do not claim certification on your behalf.

How you run it

SITEY is self-service and self-hosted. You buy online, download the installer, and deploy it inside your own infrastructure. You roll out the agents yourself. Your database, your scan results, your asset inventory and your evidence never leave your servers. The only thing that talks to us is license activation. There is no onboarding consultant and no vendor access to your environment, because there is no point in the architecture where we would need it.

Next step

Pricing is simple: $599/month, cancel anytime, or $5,999 once for a perpetual license that pays for itself against the monthly plan in ten months. Both give you the full platform: all 23 modules, all 17 scanner connectors, all eight phases. See pricing for the details, or get in touch if you have a question the documentation does not answer.