Vulnerabilities overview

Kikimora’s central repository for security findings — where they come from, the statuses they move through, and how severity, Kikimora Score, and time to resolve are defined.

The Vulnerabilities module is Kikimora’s central repository for security findings. It continuously aggregates flaws and exposures from every source the platform has: automated web application scans such as Qualys, endpoint monitoring agents such as Wazuh, external exposure discovery engines, and manual security testing.

Editing a finding that originated from a web scan or agent does not create a duplicate. On subsequent scans, Kikimora updates the existing entry instead.

Lifecycle and statuses

Each vulnerability moves through a lifecycle marked by a colored status badge:

Status	Badge color	Meaning
Open	Yellow	Active finding identified, awaiting triage or remediation.
In Progress	Orange / Blue	Remediation is underway by the assigned owner or security team.
Closed	Gray / Slate	Resolved or mitigated, verified by automated rescan or manual check.
False-Positive	Blue / Neutral	Confirmed invalid or non-threatening in this environment.

Severity and impact

Findings are graded into standard impact levels from their CVSS score:

Impact	CVSS range
Critical	9.0–10.0
High	7.0–8.9
Medium	4.0–6.9
Low	0.1–3.9
Info	0.0

Kikimora Score

The Kikimora Score refines standard CVSS metrics with asset criticality, exposure, active threat intelligence, and environment context — so two findings that share a CVSS score can rank very differently in your environment.

Time to Resolve

Time to Resolve (TTR) measures the elapsed duration between a vulnerability’s first detection and its closure. Use it to track SLA compliance and remediation efficiency.

Related modules

• Web applications
• Manual tests
• Scans
• Risk management
• Endpoints