Foundation
Strengthen coverage, intelligence, access, and reliability.
A broader vision.
A clear delivery path.
Explore today’s Windows assessment workspace and the capabilities proposed for future releases.
Capability labels use the maintained project states. Ready for controlled testing means packaged and verified but awaiting field acceptance. Partial means a working foundation exists with material gaps. Planned capabilities are not available. Scope, sequence, pricing and release dates are not committed.
From foundation to broader coverage.
Connect
Bring asset context, application evidence, and external tools together.
Extend
Add cloud and identity coverage.
Automate
Introduce reviewed assistance, patch integrations, and agent publishing.
Specialize
Validate AI, OT, governance, and isolated environments.
Windows assessment workspace
Completed assessment uploads, asset snapshots, severity summaries, and finding history.
Readiness requirement
Current hosted Windows workflow; coverage depends on collected evidence.
Software composition (SBOM)
Import a CycloneDX or SPDX JSON SBOM and match its components against OSV advisory data you import, offline. VEX statements by package URL are applied.
Readiness requirement
Field tests SBOM-01 to SBOM-03 compare results with osv-scanner on the same SBOMs and data.
OVAL evaluation on Windows
Evaluate Windows OVAL definitions you supply on the computer running VunFisher: registry values, file versions and the operating-system family. Read-only; definitions that use other test types are listed as not evaluated.
Readiness requirement
Field tests OVAL-01 and OVAL-02 compare results with OpenSCAP or the DISA SCC tool on the same computer and file.
Endpoint management (Intune)
A read-only Microsoft Intune audit of company-owned devices: compliance, encryption, jailbreak, stale check-ins and Windows 10 end of support. Personal devices are excluded.
Readiness requirement
Field tests MDM-01 to MDM-03 on an Intune lab tenant.
Vulnerability intelligence
Broader maintained CVE and exploited-vulnerability intelligence with signed updates and coverage reporting.
Readiness requirement
Validate feed freshness, provenance, matching accuracy, and regression fixtures before release.
Cross-platform assessment
Credentialed Linux assessment over SSH is available. Linux and macOS collectors, remote workforce coverage and agent health reporting are planned.
Readiness requirement
Signed installers, permission boundaries, upgrade rollback, and OS-specific collection tests.
Asset & exposure graph
Normalize asset identities and relationships across imported sources; explain attack paths and prioritization.
Readiness requirement
Every relationship needs provenance, freshness, and confidence; validate paths in controlled fixtures.
Risk prioritization & analytics
Explainable ranking, business criticality, remediation SLAs, trend reporting, and coverage gaps.
Readiness requirement
Publish score factors; test missing data and ranking behavior against reviewed examples.
External attack surface
Verified-domain inventory, certificate and DNS context, external asset attribution, and change alerts.
Readiness requirement
Verify ownership and scope before discovery; measure attribution errors and respect rate limits.
Web & API security
Baseline HTTPS, response-header and cookie checks for approved websites are available. Authenticated application mapping, API schemas and controlled DAST are planned.
Readiness requirement
Allowlisted targets, safe test profiles, authentication isolation, and reproducible evidence.
Cloud posture & workloads
Read-only AWS, Azure and Google Cloud configuration audits and a Kubernetes cluster audit, each refusing credentials that could change anything or read stored data. Workload inventory and container image scanning are planned.
Readiness requirement
Least-privilege connectors, tenant isolation, supported-service matrix, and realistic cloud test fixtures.
Cloud entitlement management
Permission analysis, unused privileges, and identity-to-resource access paths.
Readiness requirement
Explain effective permissions and validate least-privilege recommendations without automatic changes.
Data security posture
Cloud data-store discovery, exposure context, and configurable sensitive-data classification.
Readiness requirement
Minimize data collection, document classification accuracy, and test access boundaries.
Identity security
A read-only Active Directory assessment over LDAPS is available. Entra ID posture, machine identities and trust relationships are planned.
Readiness requirement
Read-only collection, documented privileges, and tested identity-relationship evidence.
OT & IoT visibility
Passive-first industrial inventory, firmware context, device change tracking, and operational risk review.
Readiness requirement
Protocol lab testing and passive collection first; explicit operator review for any active queries.
AI exposure & governance
AI and ML service discovery and an AI governance register are available. Agent inventory, integration permissions and policy checks are planned.
Readiness requirement
Consent-aware connectors, data minimization, evaluation datasets, and clear unsupported-platform labeling.
AI-assisted security workflows
Evidence-linked explanations, investigation assistance, draft remediation plans, and reviewed workflow proposals.
Readiness requirement
Require citations to findings, evaluate hallucinations, and require approval for state-changing actions.
Patch orchestration
Patch-tool integrations, staged deployments, maintenance windows, approval gates, and verification.
Readiness requirement
Test rollback, canary deployment, failure recovery, and post-change verification before enabling writes.
Security tool connectors
Documented imports and connectors for endpoint, cloud, identity, ticketing, and security operations tools.
Readiness requirement
Idempotent ingestion, schema validation, deduplication, tenant isolation, and connector health checks.
Agent Exchange
A catalog of signed collectors and reviewed workflow integrations, beginning with the Windows uploader.
Readiness requirement
Signature verification, publisher identity, scoped permissions, revocation, and version compatibility.
Compliance & isolated deployment
NIST SP 800-53 policy mapping, SCAP result import, partial local OVAL evaluation, POA&M and an authorization evidence package are available. Offline content updates and isolated deployment validation are planned.
Readiness requirement
Framework-specific review and restore tests; no claim of certification or PCI ASV approval.
Enterprise access & tenancy
Local accounts with MFA and role-based access are available. SSO, tenant separation and retention controls are planned.
Readiness requirement
Independent authorization tests, tenant isolation, recovery exercises, and migration validation.
How we aim to earn your trust.
Our product goals are explainable findings, visible coverage gaps, reversible automation, and straightforward deployment. These are design goals—not a claim that VunFisher already outperforms another product.
Explore VunFisherRelease history
Every published build
The newest build is first. 62 published builds; each is installable from Downloads as an update and keeps your accounts, licenses and reports.
- Build 2026102674 Product and version fingerprints (txvf/technology.py): banners from vsftpd, ProFTPD, Exim, Sendmail, Postfix, Dovecot, Squid, Eclipse Jetty, lighttpd, OpenResty.
- Build 2026102673 NFS, Kafka and ZooKeeper open to anonymous clients (txvf/share_services.py): TXVF-EXP-0040 NFS share exported to every host (rpcbind GETPORT, then the mount service EXPORT list, as showmount -e does.
- Build 2026102672 Cluster and time-series services without authentication (txvf/infra_services.py): TXVF-EXP-0036 Consul agent API without a token, 0037 Nomad agent API without a.
- Build 2026102671 Databases and admin APIs without authentication (txvf/admin_apis.py): TXVF-EXP-0032 MongoDB (listDatabases without credentials, count only), 0033 Hadoop YARN ResourceManager REST API, 0034 Apache Solr admin API, 0035 Kibana; one read-only request per port.
- Build 2026102670 Anonymous access to services (txvf/unauth_services.py): TXVF-EXP-0028 MQTT broker accepts anonymous clients, 0029 X11 display without authorization, 0030 rsync module list, 0031 Kubernetes API anonymous reads; one handshake per port.
- Build 2026102669 Data stores and cluster APIs open without authentication (txvf/datastore_checks.py): TXVF-EXP-0024 CouchDB, 0025 Docker Registry, 0026 etcd over plain HTTP, 0027 kubelet anonymous access; one read-only GET per product port.
- Build 2026102668 Exposed web files and status pages (txvf/web_exposure.py): TXVF-EXP-0020 .git folder, 0021 .env file, 0022 Apache or nginx status page, 0023 phpinfo() page; one.
- Build 2026102667 Management interface checks (txvf/management_checks.py): TXVF-MGT-0001 server management controllers, 0002 hypervisor consoles, 0003 server administration consoles, 0004 Jenkins dashboard without sign-in, 0005 WinRM HTTP listener.
- Build 2026102666 Ask VunFisher and Explain with AI explain how a finding was found (txvf/check_knowledge.py): the check behind a question is recognised by its ID, name or evidence wording, and the assistant is told what that check reads and from where.
- Build 2026102665 Network Exposure summary (txvf/exposure_summary.py) on network scan results and the executive report: seven categories (services open without a password, remote.
- Build 2026102664 Hygiene checks: TXVF-EXP-0013 directory listing and 0014 default web page (from GET /); 0015 mail without STARTTLS and 0016 clear-text sign-in permitted (EHLO, CAPA or CAPABILITY on the banner connection, then QUIT); 0017 MySQL without TLS (greeting flag).
- Build 2026102663 Protocol checks: TXVF-SSH-0002 weak key exchange, 0003 weak ciphers, 0004 CBC ciphers, 0005 weak MACs, 0006 DSA host key (from the SSH server's KEXINIT, read on the banner connection; no key exchange); TXVF-EXP-0011 SMB version 1 enabled (one SMB1 negotiate).
- Build 2026102662 Network exposure checks: TXVF-SVC-0006 exposure handshakes (Telnet, FTP, VNC, Redis, Memcached, Docker; ports 21, 23, 2375 and 11211 added to the default list).
- Build 2026102661 Free-license request page redesigned: two columns (what VunFisher is and what happens next; a short form with first and last name, email, I am a... role, organi.
- Build 2026102660 30-day student license: Occupation on the free-access form; Student (or /quote?for=student) shows a short form and gets an Individual license of 30 days from first activation, signed as months 0 and days 30 and verified strictly.
- Build 2026102659 Compliance control cross-reference by ID, per check (txvf/control_map.py): every check assigned by hand to topics with control IDs, replacing keyword matching on titles; NIST SP 800-53 Rev.
- Build 2026102658 What changed since the previous scan of the same scope on each scan page, with a comparison page (new, still present, not found again only when the reporting ch.
- Build 2026102657 Fix groups: Findings > Fix Groups groups open findings by the one upgrade that closes them (per component and version, rolled up across assets), with the target worked out from advisory fixed versions (strictest bound across matched sources for service CVEs.
- Build 2026102656 Software end-of-life detection: TXVF-EOL-0001 (release cycle past its end of support, High) and TXVF-EOL-0002 (within 90 days, Low), matching the scan's CPE and version against endoflife.date release cycles (MIT; full licence shipped).
- Build 2026102655 OWASP Top 10:2025 page, OWASP column and filter on Findings, category on each finding (from the CWE a web-facing VunFisher check detects, or the CWE of a CVE); mapping adapted from OWASP (CC BY-SA 4.0) in its own file txvf/owasp_top10_2025.json.
- Build 2026102654 FIRST EPSS scores and CISA Vulnrichment SSVC decisions beside KEV and NVD: live synchronization (refused on the hosted site) and offline import (EPSS .csv/.csv.gz/.json.
- Build 2026102653 Scan templates on the Policies page and in New Scan are shown as tiles with their own original colour pictures (solid tiles readable in every theme; whole tile is the link with a visible focus ring; full descriptions). Scanning unchanged; catalog 252 plugins.
- Build 2026102652 New TX Cyber plugins in the Offline Configuration Audit for PostgreSQL pg_hba.conf and postgresql.conf (TXVF-CFG-1201 to 1209: trust over the network, trust loc.
- Build 2026102651 New TX Cyber plugins in the Offline Configuration Audit for Redis (TXVF-CFG-1101 to 1108: clients without a password, short passwords, protected mode off, dange.
- Build 2026102650 New TX Cyber plugins in the Offline Configuration Audit for IIS applicationHost.config (TXVF-CFG-1001 to 1009: application pool as LocalSystem, clear-text passw.
- Build 2026102649 New TX Cyber plugins in the Offline Configuration Audit for Squid proxy configurations (TXVF-CFG-0901 to 0909: open proxy, CONNECT tunnels to any port, unsafe p.
- Build 2026102648 New TX Cyber plugins in the Offline Configuration Audit for Dovecot (TXVF-CFG-0801 to 0806: plaintext sign-in without TLS, TLS off, obsolete TLS versions, weak ciphers, passwords in logs, weak password schemes); Dovecot 2.3 and 2.4 names.
- Build 2026102647 New TX Cyber plugins in the Offline Configuration Audit for Postfix main.cf (TXVF-CFG-0701 to 0709: open relay, overly broad mynetworks, version in the SMTP ban.
- Build 2026102646 New TX Cyber plugins in the Offline Configuration Audit for HAProxy configuration (TXVF-CFG-0601 to 0608: TLS versions and ciphers on bind lines, statistics pag.
- Build 2026102645 New TX Cyber plugins in the Offline Configuration Audit for IIS / ASP.NET web.config (TXVF-CFG-0501 to 0510: directory browsing, detailed errors, debug compilat.
- Build 2026102644 New TX Cyber plugins in the Offline Configuration Audit for Apache httpd configuration (TXVF-CFG-0401 to 0407: ServerTokens, ServerSignature, TraceEnable, Options Indexes, SSLProtocol with mod_ssl's all/+/- rules, SSLCipherSuite, HSTS).
- Build 2026102643 Linux package vulnerability checks over SSH (threat model section 10, approved 31 October 2026): a credentialed Linux assessment reads the installed packages with one fixed, read-only command (dpkg-query on Debian and Ubuntu, the apk database on Alpine.
- Build 2026102642 New TX Cyber plugins in the Offline Configuration Audit: Cisco IOS / IOS-XE configuration (TXVF-CFG-0201 to 0212: Telnet on vty lines, enable password, password.
- Build 2026102641 Lifecycle review fixes: the app could not start again after an SBOM import (findings referenced a missing asset record; builds 2026102629–2026102640) (high): SB.
- Build 2026102640 Windows uploader review fixes: no step needs administrator rights (the documented "Run as administrator" steps ran user-writable code elevated) (medium); launchers start the Python Launcher by full path and only from inside the user folder.
- Build 2026102639 Import review fixes: a VEX statement about a package inside one product no longer applies to every product (product identifiers read; unidentifiable products refused) (high); VEX for one CVE no longer suppresses a group that includes other CVEs.
- Build 2026102638 Scanning-engine review fixes: exclusions honoured for single-address targets and as CIDR blocks or ranges (high); 169.254.169.254 never probed; add-on targets r.
- Build 2026102637 Sign-in review fixes: a full sign-in limit table (4,096 connections) or activation attempt table no longer refuses every new source (medium; coarse IPv4 /16 or IPv6 /40 bucket, then uncounted past a hard cap; per-account lockout remains).
- Build 2026102634 Windows agent device keys that have never been used (no upload, health report or scan poll) stop working 30 days after creation; the Windows agents page shows the expiry; keys in use are unaffected. Agent boundary document updated.
- Build 2026102633 Independent review of the hosted agent exchange (no high-severity issues). Fixes: agent uploads dated before 2020 refused and local-date display can no longer fail; assigned-scan job IDs and scan IDs type-checked.
- Build 2026102632 Independent review of the governance and decision workflows; nine fixes. Findings marked Resolved, Mitigated or Closed reopen when a later scan reports them (unless an active suppression covers them), and their completed POA&M items reopen.
- Build 2026102628 New Kubernetes Configuration Audit (/k8s, Ready for controlled testing; owner-approved threat model section 7): bearer token from a Service secret profile; TLS pinned to the scope's CA only (no system store, strict checks, TLS 1.2+, key logging off).
- Build 2026102623 New field-test guide (docs/FIELD-TEST-GUIDE.md): lab setup per kit and eight suggested sessions. Field-test tracker corrections: AZ-01 to AZ-03 use the Cloud kit (not Kit D); WEB-05 needs Kit D; MAL-03 needs Kit G.
- Build 2026102621 Hardening after independent reviews of sign-in/sessions/licensing/updates and of the scanners, credential tests, imports and exports (no sign-in or MFA bypass.
- Build 2026102620 Hardening after an independent security review of the malware, Active Directory, AWS and Intune assessments (no critical or high findings): network-path startup programs are reported, never opened; AWS and Graph requests refuse redirects.
- Build 2026102619 New Mobile / Endpoint Configuration Audit for Intune (/mdm, Ready for controlled testing): app-only token whose tenant, application and read-only roles are checked before any read; allowlisted Graph GET paths only (device actions cannot be sent).
- Build 2026102618 New Cloud Configuration Audit for AWS (/cloud, Ready for controlled testing): account match, root refusal and a write-permission simulation (fail closed) before any read; optional one-hour role credentials; SigV4 signing with the standard library (no SDK).
- Build 2026102616 New Malware Indicators Assessment (/local/new?template=malware, Ready for controlled testing): read-only checks of startup programs in user-writable folders (TX.
- Build 2026102615 New SCAP result import (/scap-import, template SCAP / OVAL Assessment, Ready for controlled testing): XCCDF 1.1/1.2 results from OpenSCAP or DISA SCC recorded as an imported assessment; failed rules become findings, errors become coverage gaps.
- Build 2026102614 New Policy Compliance Audit template (Operational): the 21 offline configuration checks reported control by control against NIST SP 800-53 Rev. 5 (14 base controls), as Gap found, No gap in checked settings, or Not assessed. Clearly not a certification.
- Build 2026102612 New AI / ML Asset Discovery template (Operational): 13 extra AI/ML ports; 15 products identified from the existing read-only GET of /; TXVF-AI-0001 inventory an.
- Build 2026102611 Read aloud now matches TX GRC-IntelliGuard: natural-voice ranking and "Most natural available" default, speed and pitch sliders with Reset and Test voice, parag.
- Build 2026102610 Read aloud in the app: "Explain this finding" (what was found, observed evidence, why it matters, what to do, how to confirm the fix), "Read summary aloud" on the executive report, and Listen on every guidance box.
- Build 2026102609 App-wide: 108 all-capitals KPI captions and column headers rewritten in sentence case (acronyms kept), and tracked capitals turned off for table headers and card captions; page-header actions grouped on the right.
- Build 2026102608 Policies page: saved policies first with one "New policy" action and a helpful empty state; templates as compact cards with one action each (Configure scan, Check credentials, Open website checks), grouped in sentence case.
- Build 2026102607 Cancelling a credentialed scan now stops the collector for the target in progress: checked every 0.25 s; the local PowerShell or ssh process is terminated, then killed after 2 s; the job is recorded as CANCELLED.
- Build 2026102606 Evidence and Coverage section on the assessment page and executive report (txvf/evidence_quality.py): one-sentence statement, findings by evidence basis (confir.
- Build 2026102605 Distribution backports: an upstream version match on a service whose evidence shows Linux/BSD distribution packaging (Ubuntu, Debian, RHEL, CentOS, Rocky, AlmaL.
- Build 2026102604 Bulk analyst decisions: from a finding's Analyst Disposition panel, apply the same decision to every other open finding with the same rule, product and version. Each gets its own exact-scoped decision linked by a batch ID (revocable separately).
- Build 2026102603 Added analyst dispositions (txvf/dispositions.py, schema migration 6 finding-dispositions): Confirmed, False Positive, Accepted Risk, Mitigated, Not Applicable.
- Build 2026102602 The download page links a CycloneDX software bill of materials for the published Windows package (downloads/VunFisher-Windows.cdx.json), generated by tools/build_sbom.py from the package itself.
- Build 2026102601 Fixed (never released): Web Scan and Database Scan runs now apply the same execution rules as every other assessment: refused on the hosted cloud server (TXVF_MODE=production) and for report-only assigned-system accounts.