What is a CVE and why does it matter?

CVE (Common Vulnerabilities and Exposures) is a standardized directory of publicly known security vulnerabilities. Each CVE has a unique ID and a CVSS score (0-10) that rates the severity. Unpatched CVEs are one of the most common entry points for cyberattacks.

How often are scans performed?

Scan targets, methods and frequency are agreed according to inventory, exposure and system load. The selected service level governs response time for qualified incidents; it does not automatically determine the scan schedule.

What happens when a critical vulnerability is found?

We assess more than the CVSS score: actual exposure, affected systems, known exploitation and existing controls. Where there is an acute material threat, we initiate necessary containment and inform you as quickly as possible. A general vulnerability notice without evidence of exploitation is not automatically a P1 incident. The service level governs qualified response, not a blanket patch-completion deadline.

Can we use the scan results for compliance audits?

Yes. We provide exportable reports in your preferred format (PDF, CSV) suitable for ISO 27001, BSI C5 and GDPR audits. Reports document all found vulnerabilities, their status and the measures taken.

Where does your CVE data come from?

From multiple sources that we cross-check against each other: the NIST NVD, the security advisories of the vendors in use, the security trackers of Debian and Ubuntu, and the warning and information service of the German BSI (CERT-Bund). The matching against your software inventory happens through our scans - turning the global feed into a list that only concerns your systems.

Do you patch automatically?

Not indiscriminately. Every relevant CVE is first assessed for affected systems, exploitability, exposure and existing controls. Regular updates are applied in the next appropriate maintenance window. An acute material threat may require immediate, preferably reversible protective action. Implementation follows a documented decision and the agreed approval and action boundaries.

What about zero-days?

A zero-day is a vulnerability for which no patch exists yet - so patching is not an option. Instead, we reduce the attack surface: limit exposure (firewall, VPN), implement vendor-recommended workarounds and sharpen monitoring on the affected systems. As soon as a fix is available, it is applied with priority.

CVE Monitoring as a Managed Service

Vulnerability management for Linux and cloud infrastructure: automated scans, prioritized alerting and risk-based patch management. Affected systems, decisions and actions are documented transparently.

Critical · CVSS 9+
High · CVSS 7+
Medium · CVSS 4+

Request CVE monitoring Review service scope

Reviews

IT Beratung Service Consulting Soforthilfe

Companies worldwide trust WZ-IT

Read client reviews

Ongoing operations component

What is CVE Monitoring?

Every day new security vulnerabilities in software are discovered and published as CVEs (Common Vulnerabilities and Exposures). CVE monitoring means: your systems are continuously matched against this database.

Detect, assess, and assign remediation responsibility
CVE monitoring is agreed as a standalone scope or as part of a managed operations contract. System count, scanning method, notifications, and patch responsibility are defined before operations begin.
More than the CVSS score
We identify affected packages and assess exposure, exploitability and existing controls in addition to the CVSS score. This determines the appropriate patching or containment action.
Monitoring and prioritisation
Affected packages and components are checked against current CVE information. Exposure, exploitability, and existing controls determine priority.
Patching only within the agreed scope
Alerts alone do not remediate a vulnerability. Whether WZ-IT plans and applies updates or your team takes over is documented explicitly, including approvals, maintenance windows, and exceptions.

Our Approach

Four Steps to Secure Infrastructure

From automated scanning to documented risk assessment and action, our CVE process is transparent and traceable.

01
Continuous Inventory Matching
Inventory & Exposure: The software inventory of managed systems is continuously matched against up-to-date CVE databases. Active checks from the network are covered by vulnerability scanning.
02
CVE Alerting
Automated Notification: Automatic notification for new CVEs affecting your deployed software versions - prioritized by CVSS score.
03
Patch Management
Risk-based & documented: We assess exposure, exploitability, affected systems and existing controls. The service level governs response, not a blanket patch-completion deadline.
04
Compliance Reporting
Documentation: Regular reports on the security status of your systems - for audits, ISO certifications and internal compliance.

Scan Scope

What We Scan

From OS packages to container images - we cover all layers of your software infrastructure.

Layer 1

OS Packages
Debian/Ubuntu APT packages · RPM-based distributions · Kernel versions · Systemd services

Layer 2

Application Dependencies
npm / yarn packages · Python pip dependencies · Go modules · Java Maven/Gradle

Layer 3

Container Images
Docker image layers · Base image CVEs · Registry scanning · Runtime configuration

Layer 4

Network Services
Open ports & services · SSL/TLS configuration · Web servers (Nginx, Apache) · Database versions

The Process

From CVE to Decision

New vulnerabilities are published every day - only a few affect your systems, and even fewer require immediate action. The value is not in collecting CVEs, but in filtering and assessing them.

01
Feed Matching
New CVEs arrive daily from multiple sources: NVD, vendor advisories and the distribution security trackers. No single feed is complete - which is why we cross-check several against each other.
02
Relevance Filter
Every CVE is checked against your software inventory: deployed packages, versions, container images. What does not run in your environment does not trigger an alert - which keeps the noise low.
03
Prioritization
The CVSS score alone is not enough. We additionally assess exploitability and exposure: is there a public exploit? Is the service reachable from the internet or only internally behind a VPN? Not every 9.8 is critical in your environment - and some 6.5 very much is.
04
Patch Decision
The result is a documented decision: a regular patch in the appropriate maintenance window, a compensating control or immediate containment where there is an acute material threat. The exact action depends on risk, approvals and technical scope.

The difference to a bare scanner: a tool hands you a list of a hundred findings. We hand you the few decisions that actually need to be made this week.

Decisions this weekExample

New CVEsfiltered by relevance
OpenSSLpatch in maintenance window
Web serverpublicly reachable · contain now

Operating model

One alert flow for security and operations

For us, CVE monitoring is not an isolated tool but part of a coordinated operating model: vulnerability and infrastructure alerts follow the same documented alert and escalation paths. Recurring human assessment of code changes and dependencies is covered by the AI Code Review Retainer; required code changes and releases are covered by software maintenance.

Request CVE monitoring Compare all service levels

Connected services

Monitoring

Monitoring as a Service from €49.90

24/7 infrastructure monitoring from €49.90 per server/month

Operations

Linux server management

Combine monitoring, maintenance, and an agreed response

Code

AI Code Review Retainer

Software

Software maintenance for custom applications

Service Levels

Response by Service Level, remediation by risk

The service level defines when a qualified response begins. The appropriate protective or patching action follows from affected systems, exploitability, exposure and technical scope.

Service level	Qualified response	Service window	Scope
Essential	Initial technical response to P1 by the end of the next business day	Mon-Fri 08:00-17:00 CET/CEST	Assessment and regular remediation in the appropriate maintenance window.
Business	P1 within 4 service hours	Mon-Fri 08:00-18:00 CET/CEST	Faster qualified response during the service window.
Production	P1 within 60 minutes	P1 around the clock	24/7 P1 response for the explicitly covered customer environment.
Critical	P1 within 30 minutes	P1 around the clock	Available only after readiness review, runbook approval and capacity confirmation.

A response time is not a guaranteed resolution time. General vulnerability notices and vulnerabilities without evidence of exploitation are not automatically P1 incidents. Compare all service levels

Sources

Tools & Feeds

We do not invent our own vulnerability data - we evaluate the established sources and match them against your systems.

NVD (National Vulnerability Database)
The central CVE database maintained by NIST with CVSS ratings - our basis for matching and scoring. nvd.nist.gov
Vendor Advisories
Security announcements from the software in use - from Proxmox and Nextcloud to PostgreSQL. Often faster and more precise than the corresponding NVD entry.
Distro Security Trackers
The Debian Security Tracker and Ubuntu Security Notices show whether and in which package version a vulnerability is fixed for your distribution - decisive for the patch decision. Debian Tracker Ubuntu Notices
BSI CERT-Bund (WID)
The warning and information service of the German BSI aggregates and assesses current vulnerabilities for the German market - including a criticality assessment. wid.cert-bund.de

Frequently Asked Questions

Answers to the most important questions

Knowledge

Further guides

These services complement your vulnerability management.

Complementary services

Relevant next steps

Practical cases from recent vulnerabilities

Reviews & projects

Operations that visibly relieve customers

Customer feedback on monitoring, updates, maintenance, support and stable production systems.

Networking & Provisioning

WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.

Steve KirchnerManaging Director, nextGYM GmbH

View project

International

Built in Germany's Ruhr Valley. Running worldwide.

WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.