Vulnerability Management — FAQ

Vulnerability Management — FAQ

What is SiteWALL's Vulnerability Management module?
It's the part of SiteWALL that scans your applications for security weaknesses, prioritizes what it finds by risk, and produces a report with the exact steps to fix each issue. It covers three things: Vulnerability Scanning (periodic scans to uncover weaknesses), Risk Assessment (prioritizing findings by risk level and impact), and Remediation Guidance (step-by-step fix instructions).

How often are applications scanned?
Monthly, using a combination of automated scanning tools and manual verification. You can see the exact date and time of the last scan for each application in the Vulnerability Management dashboard.

Where do I find scan results and reports?
In the SiteWALL dashboard under Vulnerability Management. The main table lists every protected application with its current High/Medium/Low/Info counts and last-scan timestamp. For historical reports, use Vulnerability Assessment Reports, where you can filter by application and by month and download any past report as a PDF.

Who performs the assessment?
The scans and the resulting report are produced by SiteWALL / PageNTRA Infosec Pvt Ltd. No manual write-up is required on your end.

Is this the same as a penetration test?
No. This is an unauthenticated vulnerability assessment — professional scanning tools plus manual verification, run without login credentials, aimed at finding what an outside attacker could see without access. It's not a full authenticated penetration test. If you need scans against logged-in / authenticated areas of your application, contact SiteWALL Support. 

What sections does the Vulnerability Assessment Report contain?
  • Executive Summary
  • Scope of the Assessment
  • Key Findings (backend platform, vulnerability counts by severity, OWASP Top 10 mapping)
  • Risk Assessment (Web Security Score, risk rating, missing security headers)
  • Appendix and References (compliance standards considered)
  • Vulnerability Score Card (severity bar chart, 6-month severity trend table, severity-over-time chart)
  • Technical Report (per-issue detail with evidence)

    • What is the Web Security Score, and what do the letter grades mean?
    It's an overall grade (A–F) summarizing how exposed the application is, based on the number and severity of open findings plus other checks like missing security headers. An "F" with a "High" risk rating means high-severity issues are open and need attention; better grades mean fewer/less severe findings. (Learn more)

    What does the OWASP Top 10 mapping tell me?
    Each finding is tied to the relevant OWASP Top 10 category (for example, A02:2025 – Security Misconfiguration), so you can see at a glance which broad class of risk you're exposed to, not just a list of individual bugs.

    What does an individual finding in the Technical Report include?
    For every issue: a summary box (severity, confidence, host, path), a plain-language description of the issue and why it matters, the actual HTTP request and response that triggered the finding (so your developers can reproduce it), specific remediation steps, and a formal vulnerability classification.

    What's the 6-month severity table and trend chart for?
    They show how your High/Medium/Low/Info counts have moved over the past six reporting periods, so you can see whether the application's exposure is trending up or down rather than judging from a single month in isolation.

    What counts as "High," "Medium," "Low," and "Info" severity?

    Severity reflects likely impact to a typical organization if the issue were exploited — High findings (e.g. an overly permissive CORS policy trusting arbitrary origins) pose the greatest risk; Low findings (e.g. missing HSTS enforcement) are real but lower-impact; Info items are observational.

    What does "Confidence" mean if it's separate from severity?

    Confidence reflects how reliable the detection method was — Certain means the scanner (or manual tester) directly confirmed the issue; Firm and Tentative indicate progressively less certainty, useful for triaging what to verify first.

    Does a high finding count mean the application is currently exposed to attack?

    It means the finding was present at scan time on the application itself. Separately, SiteWALL WAF sits in front of the application and can virtually patch many classes of these issues at the network layer in the meantime — but the underlying application-level fix described in the report is still the durable remediation and should not be skipped.

    How is the backend platform identified?

    The scanner fingerprints the application stack (for example, "WordPress 7.0") as part of the assessment; this is reported alongside the findings since platform and version often determine which known vulnerabilities are relevant.

    Who do I contact about a finding I don't understand or think is a false positive?
    Email SiteWALL Support at support@pagentra.com with the application name, report date, and the specific finding — the team will review it with you.

    Does SiteWALL help with the actual remediation, or only report the findings?
    The report includes step-by-step remediation guidance for each issue so your team can fix it directly. For issues SiteWALL WAF can mitigate at the network layer in the meantime (virtual patching), that protection is applied automatically where applicable — but contact Support if you'd like help prioritizing or interpreting a remediation plan.