OpenVAS remediation starts once the scan finishes. Someone has to decide which Greenbone findings are real, write a fix that suits each host, get it approved, apply it, and prove the finding is gone. SITEY is self-hosted software that connects to the OpenVAS scanner you already run. It starts and stops OpenVAS scans and pulls the results into one deduplicated queue. Each finding then goes through AI triage, a host-specific fix, a human approval gate, an agent that applies the change, and a rescan. OpenVAS still does the detection. SITEY runs the work of closing what it finds.
How SITEY runs OpenVAS scans and pulls the results
SITEY talks to OpenVAS over GMP, the Greenbone Management Protocol. You enter the OpenVAS URL, username and password once on the scanner integrations page. Saved secrets are returned to the browser masked, and only the infrastructure-manager role can change the connection.
Pick an agent group. SITEY resolves it to the members’ current addresses, creates the OpenVAS target, selects the scan configuration and starts the task.
Choose a fast profile, or a deep one with UDP off, common UDP ports or full UDP. Each option shows an estimated relative cost before you commit.
Before an OpenVAS group scan, SITEY probes each target with ping and a TCP connect, and runs a traceroute for hosts that look troubled where the tool is installed on the server. Unreachable hosts are set aside and the diagnosis is stored on the scan, so a clean host can be told apart from one the scan never reached.
A background worker polls the task every 20 seconds for status and progress. Stopping a scan sends a real stop command to OpenVAS.
When the task completes, SITEY downloads the report XML, keeps the original on disk and imports the findings. A finding that is already known raises the detection count on the existing record and does not create a second row.
If you prefer to run scans inside OpenVAS, upload the XML export. It goes through the same parser and deduplication.
The OpenVAS remediation workflow, step by step
OpenVAS findings go through the same eight-phase pipeline as every other source: discovery and scanning, collection and deduplication, AI validation, risk scoring, assignment, AI remediation planning, approval-gated patching, and retest and closure. To fix OpenVAS findings, the path from report to closed record looks like this.
- Deduplicate
Every finding is matched on name, risk, target IP, port and scanner. OpenVAS severities are mapped onto the platform scale and CVE identifiers carry over. A finding seen in five weekly scans stays one record, with a detection history.
- Triage with AI
AI triage gives each finding a priority score from 0 to 100 and a false-positive probability, using CVSS, FIRST EPSS and the CISA KEV catalogue. The reasoning is stored with the record, and an analyst can reverse any verdict.
- Write a host-specific fix
AI remediation planning writes a bash script for Linux or a PowerShell script for Windows, based on that host’s operating system, installed software and diagnostic output. Every script must pass a blocklist and a syntax check, and reboots are not allowed. If only the supplier can fix a finding, SITEY opens a vendor-contact record instead of writing a script.
- Approve
The fix becomes a job in pending approval. Approval gates offer four autonomy levels and classify 18 AI actions by risk. High-impact changes wait for a named person, who can read the exact script before it runs.
- Apply with the agent
The SITEY agent on the Windows or Linux host runs the approved script. It then reports the result and the host’s inventory back to SITEY.
- Rescan
A successful job moves the finding to awaiting retest, not to closed. Retest and closure runs OpenVAS against the target again before anything is marked resolved.
An exit code of zero only claims the fix worked. A rescan that stops reporting the issue proves it.
Be clear about what an OpenVAS rescan proves in SITEY today. The OpenVAS retest judges the whole scan, not each finding: the vulnerability stays open as long as the rescan returns results on that target. On hosts with other open findings, an analyst confirms the closure. Nessus retests, by contrast, match the individual finding.
What your Greenbone feed decides, and SITEY does not
SITEY does not supply a feed for OpenVAS and does not add vulnerability tests to it. What an OpenVAS scan can detect depends on the feed your installation runs. Greenbone remediation through SITEY covers only what your scanner reports.
Greenbone’s own feed comparison marks vulnerabilities in enterprise products, such as Cisco, MS Exchange and Palo Alto, as missing from the Community Feed and covered by the Enterprise Feed. Greenbone also describes OPENVAS FREE as intended for private use and non-professional IT infrastructures, running on the Community Feed. If your estate depends on such products, check your feed first.
OPENVAS AI and SITEY: where each one stops
Greenbone lists OPENVAS AI under “Upcoming Solutions” on its website. Its product page says it uses a built-in on-premise LLM and runs fully containerized inside the customer’s infrastructure. It turns scan results into structured, risk-based remediation actions, recommendations with CVE context, and “automatable tasks” for IT and SecOps workflows. Greenbone states that the data stays in your network. If your policy forbids sending finding text to any outside model, that design meets a real requirement. SITEY does not match it out of the box: its AI calls go to the OpenAI-compatible endpoint you configure, unless you point it at an endpoint you host yourself or switch AI off.
As read on 24 September 2026, Greenbone’s page describes recommendations and tasks, but not OPENVAS AI carrying out fixes on hosts. SITEY is built around the steps that follow a recommendation: a named approver, an agent that applies the approved script, and a rescan before closure.
| SITEY | OPENVAS AI (per Greenbone’s product page) | |
|---|---|---|
| Availability | Available now, bought online | Listed under Upcoming Solutions |
| Where the model runs | The OpenAI-compatible endpoint you choose, which can be one you host; AI can be switched off | Built-in on-premise LLM, containerized inside your infrastructure |
| What it produces | A bash or PowerShell script for a specific host, held for approval | Risk-based remediation actions, CVE-context recommendations, automatable tasks |
| Applying the fix on hosts | SITEY agent on Windows and Linux, after approval | Not described on the product page |
| Finding data sent to a model | Finding text and host context go to your AI endpoint when AI is enabled | Greenbone states the data stays in your network |
Setting up SITEY with OpenVAS
SITEY is self-service. You buy it online and install it yourself, with no sales call. The server runs on Linux only, with your own PostgreSQL database.
- Install and activate
Install SITEY on a supported Linux server and activate the license over outbound HTTPS to siteyvm.com.
- Connect OpenVAS
Enter the OpenVAS URL, username and password on the Integrations page. The SITEY server must be able to reach your scanner.
- Deploy agents and group them
Install the agent on the Windows and Linux hosts you want SITEY to fix, then put them into groups for OpenVAS scans to target.
- Decide on AI
Add a key for an OpenAI-compatible endpoint, or leave AI off. Deterministic scoring and deduplication work without a key. AI analysis and script generation need one.
- Set autonomy, then scan
The default autonomy level stops at the approval gate. Start with a fast OpenVAS profile and review the queue before approving fixes.
Pricing is flat: 599 USD per month, cancelable, or 5,999 USD for a lifetime license with one year of updates and the engine feed. There is no per-asset fee and no scan quota, but each license has an IP quota; see the pricing page. AI usage is billed by your AI provider and is not included. SITEY is built by SITEY Bilisim at Giresun Teknopark in Bulancak, Turkey. Its founder has worked as a security researcher since 2014 and is credited with CVE-2021-40960 and CVE-2022-3792.
SITEY is not SaaS. You install and run it on your own Linux server, and you need a technical person to set it up and operate it. It is not air-gapped: it needs outbound HTTPS to siteyvm.com for license validation and the engine feed. Each license has an IP quota; see the pricing page. AI features need your own API key, and you pay the AI costs. For OpenVAS specifically: SITEY does not supply a Greenbone feed, its OpenVAS retest works at scan level rather than per finding, and its recurring schedules currently queue scan entries without launching OpenVAS on their own.
Frequently asked questions
Does SITEY replace OpenVAS?
No, it manages OpenVAS. OpenVAS remains your scanner, and your Greenbone feed decides what it detects. SITEY starts and stops scans, imports the results, and runs the triage, fix, approval, apply and rescan workflow around them. If you are still choosing a scanner, read Nessus vs OpenVAS.
Does any data leave my network, and is SITEY air-gapped?
SITEY is not air-gapped. It makes two connections to siteyvm.com, one for license activation and validation and one for the engine feed. Neither carries scan data. OpenVAS traffic stays between your SITEY server and your scanner, and findings are stored in your own PostgreSQL database. Optional outbound calls go to the OpenAI-compatible AI endpoint you choose, which receives finding text and host context (you can use an endpoint you host or turn AI off), and to NVD, CISA KEV, FIRST EPSS, MSRC and the Microsoft Update Catalog. The security page lists each connection.
Can a fix run on a server without anyone approving it?
At the default autonomy level, no. The pipeline stops at the approval gate until an approver releases the batch. A policy can be set to full auto, scoped by severity, tags and agent group, but operations that touch firewalls, reboots, domain settings or credentials still wait for a person, as does anything the risk classifier cannot place. Read-only diagnostic scripts run on agent hosts without a separate approval.
How does SITEY verify that an OpenVAS finding is fixed?
After a successful job, the finding moves to awaiting retest and SITEY runs OpenVAS against the target again. That retest works at scan level, not finding by finding. The vulnerability stays open while the rescan still returns results on that host, so an analyst confirms closures on hosts with other open findings.
Can I keep running scans in OpenVAS and only import the results?
Yes. Upload the OpenVAS XML export and it goes through the same parser and deduplication as scans SITEY starts itself. The findings then follow the same triage, approval and retest steps.
Sources
- Greenbone, OPENVAS AI product page: https://www.greenbone.net/en/openvas-ai/ (accessed 24 September 2026)
- Greenbone, feed comparison: https://www.greenbone.net/en/feed-comparison/ (accessed 24 September 2026)
- Greenbone, OPENVAS FREE: https://www.greenbone.net/en/openvas-free/ (accessed 24 September 2026)
OpenVAS and Greenbone are trademarks of Greenbone AG. Nessus is a trademark of Tenable, Inc. SITEY is not affiliated with or endorsed by Greenbone AG or Tenable, Inc.