Your scanner found the problem, scored it and exported it. It did not fix anything, and that is where most vulnerability programs stall. SITEY is self-hosted vulnerability remediation software that picks up findings from the scanner you already run, triages them with AI, writes a fix for the specific host, holds that fix at an approval gate, has an agent apply it, and sends the finding to retest instead of marking it fixed when the script succeeds.
Works with the scanner you already run
SITEY does not replace your scanner. It imports results from 16 scanners and testing tools, deduplicates them and builds one queue. It launches scans directly in Nessus and OpenVAS; for every other tool, you keep scanning as you do today and SITEY imports the results.
If Nessus is your main source, see how the Nessus integration works.
Why scanner findings stay open
Most teams are not short of findings; they are short of hours to close them.
Each scan cycle adds rows faster than engineers can clear them, and duplicates from several scanners inflate the queue. Critical findings age because nobody had the afternoon to write the fix.
“Upgrade to the vendor-supplied version” says nothing about the build on this machine or whether the service is running. Someone still has to log in, check by hand and write the script.
A change is agreed in a message, then edited or run on more hosts than anyone approved. When an auditor asks who authorized it, the evidence is a screenshot.
The expensive part of vulnerability management is rarely the scan. It is the distance between “we know about it” and “it is fixed and verified”.
How SITEY closes a finding
SITEY moves every finding through an eight-phase pipeline: discovery and scanning, collection and deduplication, AI validation, risk scoring, assignment, AI remediation planning, approval-gated patching, and retest and closure. The remediation half of that loop works like this.
- Triage separates real risk from noise
AI triage gives each finding a false-positive probability and a priority score, and draws on CVSS, EPSS and the CISA KEV catalog. The reasoning is stored with the finding, so an analyst can read it and reverse the verdict.
- A read-only diagnostic checks the live host
For a single-host plan, if the host runs a SITEY agent and an AI provider key is configured, SITEY sends the agent a diagnostic script that is validated as read-only before it leaves the server. Its output tells the planner what is actually installed and running there. If the agent does not answer in time, planning continues without that evidence and the plan records why.
- AI writes a fix for that host
AI remediation planning writes a bash or PowerShell script for that specific host. The plan comes with a description, a risk warning, the affected services and a verification command. When only the supplier can fix a finding, SITEY opens a vendor record instead of guessing at a script.
- The job waits at an approval gate
The fix becomes a patch job in pending approval. An authorized approver can read the actual script, the target agent and the operation before releasing it. The decision is recorded with the approver’s name and a timestamp. Only a policy you set to full auto releases jobs without this step, and high-impact changes still stop for a person.
- A snapshot comes before the change
Where policy requires it, a snapshot is taken first: VSS on Windows, timeshift or LVM on Linux, or a registry export for registry-only fixes.
- The agent applies the approved script
SITEY agents on Windows and Linux endpoints pick up the approved job, run it, and report the result and updated inventory back to your server.
- A retest decides whether it is closed
A successful job moves the finding to awaiting retest, not resolved. Retest and closure re-runs the scan for Nessus and OpenVAS findings: Nessus results are matched finding by finding, OpenVAS rescans are judged at scan level. Findings without a scanner retest path are checked for a completed fix on that exact host through its agent, and stay open for a manual check if no agent matches.
How automated remediation stays safe
Automated vulnerability remediation software only works if the team trusts the brakes. When nobody can say what the automation may touch, it gets switched off after the first bad push. SITEY’s remediation automation is built around these controls.
Four levels: off, diagnose only, until Gate 1 (the default) and full auto, each scoped by severity, tag and agent group. The AI assistant’s 18 risk-classified write actions show an approval card with the tool, its arguments and its risk level before they run.
A safety classifier caps what any policy can ask for. Hosts you mark as critical stay at diagnose only, and database and web findings wait at Gate 1 by default. Changes that touch firewalls, domain settings or credentials fail closed to a human gate, even under full auto.
Generated scripts are rejected if they format disks, delete registry keys, stop EDR or event-log services, clear event logs, reboot, run encoded or downloaded code, or disable network adapters. A service restart is the most a plan may do.
If verification shows the vulnerability is still open after an autonomous fix, the engine can raise a rollback job against the pre-change snapshot and hand the finding to a person.
A global kill switch stops autonomy; a mutation-only pause stops changes while diagnosis continues. Canary hosts go first, and caps limit concurrent changes.
Approvals, rejections and cancellations go into the autonomy action log with the approver’s identity, and a structured comment is added to the vulnerability itself.
See approval gates and autonomous operations for the full control model.
Remediation approaches compared
Several vendors now automate part of remediation, and some do things SITEY does not. This table summarizes vendor pages, press releases and one news report, as accessed on 24 September 2026. It is not a full feature comparison.
| How the fix is produced | Control, verification and delivery | |
|---|---|---|
| SITEY | Imports findings from the scanner you run and checks the host with a read-only diagnostic. AI then writes a bash or PowerShell script for that host. | Your approver releases high-impact changes, and closure waits for a retest step. Self-hosted on your Linux server at a fixed price. |
| Vicarius vRx with ScriptAI | Announced 23 September 2026. Generates native Bash and PowerShell detection and remediation scripts for flaws with no vendor patch, following a precheck, apply, verify, rollback sequence. | Vicarius researchers check script logic before anything runs. A deterministic evaluator with no language model makes the pass or fail call, and each case gets a cryptographically signed evidence manifest. The vRx AWS Marketplace listing is SaaS, and pricing is based mainly on managed assets. |
| Qualys (TruRisk Eliminate, TruConfirm, Agent Val) | Qualys describes a loop of detection, prioritization, exploit validation with TruConfirm and Agent Val, remediation and re-validation. Patch reliability is scored before deployment. | Patches roll out in waves from the least to the most critical assets. Humans define the rules and thresholds and review exceptions. |
| Tenable Patch Management | Patching for Windows (including drivers and BIOS), Mac, Linux and 20,000+ third-party applications, with SLA-driven policies. Tenable calls it autonomous patching. | Controls for deployments, testing and approvals. Deployments can be scheduled, paused or rolled back. Available on-premises or as SaaS, on an annual subscription priced by asset. |
| Microsoft Intune Vulnerability Remediation Agent | In preview. Produces prioritized guidance from Defender Vulnerability Management data. | Microsoft’s documentation says the agent takes no action on devices, and “mark as applied” is the admin’s own attestation. Requires Security Copilot. |
| NinjaOne | Continuously matches endpoint software versions against AI-powered CVE intelligence, with no scan windows, and links vulnerabilities to patches. | Integrates with NinjaOne Autonomous Patch Management. The page shows no price. |
The strengths on that list are real. Vicarius puts a researcher review and a signed evidence trail behind every script, and Tenable’s catalog covers more than 20,000 third-party applications. SITEY’s difference is narrower: it runs on your own server, works from the scanner you already own, writes a script for that specific host that your own approver can read before release, and costs a fixed price rather than a per-asset fee.
SITEY is not SaaS. You install and run it on your own Linux server (Ubuntu 22.04 or 24.04, Debian 12, RHEL or Rocky 9) with your own PostgreSQL database, so it needs a technical person to install and run it. There is no Windows server installation. Each license has an IP quota; see the pricing page. SITEY is not air-gapped: it connects to siteyvm.com for license activation and the engine feed. AI features need your own API key, and that AI cost is not included in the price.
A vulnerability remediation tool at a fixed price
Monthly subscription that you can cancel.
Perpetual license, with one year of updates and the engine feed included.
Both are fixed prices, with no per-asset fee and no scan quota. Each license has an IP quota; see the pricing page. SITEY is self-service: you buy online and install it yourself, with no sales call. AI provider costs are extra.
SITEY is built by SITEY Bilişim at Giresun Teknopark in Bulancak, Türkiye. The founder has been a security researcher since 2014, and that research includes CVE-2021-40960 and CVE-2022-3792. Questions about data handling are answered on the security page.
Frequently asked questions
Does SITEY replace my vulnerability scanner?
No. It imports results from 16 scanners, including Nessus, Qualys, OpenVAS, Burp Suite and Nuclei, and launches scans directly only in Nessus and OpenVAS. For other tools you keep scanning as you do now.
Will SITEY change my servers without approval?
Read-only diagnostic scripts run without a separate approval. Every job that changes a system is created in pending approval, and new autonomy policies stop at Gate 1 by default. You can allow full auto for narrow classes of findings, but high-impact changes such as firewall, domain or credential changes still stop for a person.
What data leaves my network? Is SITEY air-gapped?
SITEY is not air-gapped. Your server makes two connections to siteyvm.com, one for license activation and validation and one for the engine feed. Neither carries scan data. Optional outbound calls go to the OpenAI-compatible AI endpoint you choose, which receives finding text and host context when AI features are on, and to NVD, CISA KEV, FIRST EPSS, MSRC and the Microsoft Update Catalog. You can point AI at a model endpoint you host yourself, or turn AI off.
What happens if a fix breaks something?
Where policy requires it, a snapshot is taken before the change. If an autonomous fix fails verification, the engine can queue a rollback job against that snapshot and hand the finding to a person. For jobs you approved by hand, you trigger the restore from the job page.
Which operating systems are supported?
The SITEY server runs only on Linux: Ubuntu 22.04 or 24.04, Debian 12, RHEL or Rocky 9, with your own PostgreSQL database. Agents run on Windows and Linux endpoints and apply fixes as PowerShell or bash scripts.
Sources
- Vicarius ScriptAI launch and review model: SiliconANGLE, https://siliconangle.com/2026/09/23/vicarius-launches-scriptai-to-write-fixes-for-flaws-with-no-vendor-patch/ (accessed 24 September 2026)
- ScriptAI script sequence: GlobeNewswire, https://www.globenewswire.com/news-release/2026/09/23/3367520/0/en/vicarius-releases-scriptai-applying-genai-to-industrialize-remediation.html (accessed 24 September 2026)
- vRx as SaaS: AWS Marketplace, https://aws.amazon.com/marketplace/pp/prodview-pnvxqhtkzpckq (accessed 24 September 2026)
- vRx pricing model: Vicarius, https://www.vicarius.io/pricing (accessed 24 September 2026)
- Qualys TruRisk Eliminate loop: Qualys blog, https://blog.qualys.com/product-tech/2026/09/17/the-autonomous-engine-behind-remediation-and-what-finally-makes-it-safe (accessed 24 September 2026)
- Tenable Patch Management: Tenable, https://www.tenable.com/products/patch-management (accessed 24 September 2026)
- Intune Vulnerability Remediation Agent: Microsoft Learn, https://learn.microsoft.com/en-us/intune/copilot/agents/manage-vulnerability-remediation-agent (accessed 24 September 2026)
- NinjaOne vulnerability management: NinjaOne, https://www.ninjaone.com/vulnerability-management/ (accessed 24 September 2026)
Nessus and Tenable are trademarks of Tenable, Inc. Qualys is a trademark of Qualys, Inc. Microsoft and Intune are trademarks of Microsoft Corporation. Other names on this page are trademarks of their respective owners. SITEY is not affiliated with or endorsed by any of these companies.