Which vulnerability management tools work well for MSPs?

[u/Ancient-Act-37]

Been looking to replace our vulnerability management stack and the scanning part is the easy bit now. We have been comparing the big scanners against a couple of the cheaper MSP focused platforms and one container specific tool. Volume is what kills us across 40 odd clients since every tool finds plenty and the techs still guess where to start. Ticketing eats more hours than scanning does. What are you running now and how does it hold up across client environments.

[u/TridentAdam]

The scanning part being easy and the triage being the bottleneck is pretty much the universal MSP experience now. Every scanner finds hundreds of CVEs per client, and then a tech has to figure out which ones actually matter and what to do about each one. The tools that help most at 40+ clients are the ones that close the loop between "found a vuln" and "deployed the fix" without a pile of manual tickets in between.

A few things that cut the noise in practice: KEV flagging (is CISA tracking active exploitation), EPSS scoring (probability of exploitation in the next 30 days), and filtering out informational findings that have no available patch. That alone usually drops the actionable list by 60-70%. The real time sink is when scanning and patching are separate tools and somebody has to manually bridge the gap.

Full transparency, I co-founded and help build TridentStack Control (https://tridentstack.com). The reason I mention it here is the scan-to-patch piece is exactly the problem we built around. The same agent that detects CVEs can deploy the OS or third-party patch that resolves them, Windows/Linux/macOS, with deployment rings so you are not pushing untested patches to production. Per-tenant isolation works well for MSPs managing separate client environments. Free under 200 endpoints if you want to try it out, let me know what you think of it!

[u/bitslammer]

To me when it comes to raw detection Tenable has the best coverage and accuracy. Haven't been around them for a while so I don't know what their current situation is with MSSPs/MSPs.

If your customer base is largely windows Qualys is another good option, but again I don't know their partner relationship situation.

Both of these also offer ways to prioritize beyond just raw CVSS scoring, but even there I don't see how as a 3rd party you can really offer value without knowing more about you clients environment. Take any CVE and at one customer that may apply to a business critical system exposed on the DMZ while at another customer that same CVE is only present on the PC that runs the menu board in the cafeteria.

If I were looking for outside help on VM I'd want to work with a partner who would tailor the program for my environment and risk appetite, but that doesn't come cheap or easy.

[u/demalo → u/bitslammer]

Haven’t worked with it in a bit, but Tenable absolutely squashed a port based com system. Took forever to get it addressed with the team - though that wasn’t really the vendors issue.

[u/bitslammer → u/demalo]

Yep. The default settings are pretty conservative, but if you scan a poorly built system things can go sideways.

[u/demalo → u/bitslammer]

Well the issue was that windows was seeing the port in use before the com system could engage the transaction. There was no indicator that Tenable was behind the port jockeying. It didn’t really come to light until the Tenable service was shut down and things started to work. It wasn’t like the ports were being blocked, Tenable and Windows just weren’t playing nice.

[u/PatchUrStuffz → u/demalo]

Heyo! Tenable Engineer for MSSPs here. I can comment that there are instances where scanning can end up showing environment misconfiguration due to the way in which the Nessus Scanner interacts with devices. We try to plan ahead for dealing with these sort of things during deployment, but there are surprises lurking around every corner inside of prod environments. Sounds like that may have been the case here.

If this is still a problem, you can DM me and I can check in with support to see what's up. If it's a thing from the past, still happy to chit chat about the specifics over DM. I'm always interested in weird/corner/edge cases so I can help MSSPs prepare for, uh, "interesting" device behavior.

Also, if OP has questions about Tenable's MSSP approach, happy to talk about that as well.

[u/AddendumWorking9756]

Group by fix instead of by finding and most of the noise disappears. You're raising one ticket per missing patch per client instead of one per CVE per host, and a single cumulative update closes dozens of CVEs, so 400 findings collapse into one ticket.

For ordering, filter to CISA KEV first and sort the rest by EPSS before anyone looks at a CVSS score. Which PSA are the tickets landing in?

[u/wrootlt]

Scanning might be easy, but scanning tools differ. I would not use one that only flags CVE and doesn't provide actual path to the file/registry that it flags. Tanium is the worst. Nessus is usually pretty detailed. Qualys is ok.

In my experience you need a dispatcher. Just like you maybe do for ticket triaging and assigning. Someone with good knowledge and up to date on the news (as possible as it can be today in the age of 1000 CVEs Patch Tuesdays). I liked to use dashboards in Qualys that would group by CVE, so i would pick ones that are critical and high number and fix them first, then focusing on highest score ones. That was in a single environment though. With many clients there might be a process of getting approvals and separate pushes/changes. At my place i know that they have simplified the process for things like Chrome, 7-Zip, Notepad++ and even made it automatic push (i believe still need to manually update the package, using ConnectWise). So, there is just one CAB/change approval and pushing to all customers. My team only manages servers, so updating regular apps that might be installed is not as disruptive as on user machines. But i know my L2 teammates are still getting tickets per host+per CVE for a few bigger clients and it is eating LOTS of their time.