# US 2022/0046050 A1 · Automated vulnerability assessment with policy-based mitigation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0046050 A1 - Document ID: US20220046050A1 - Status: Published application - Kind: A1 - Application number: 17/452,151 - Filed: 2021-10-25 - Published: 2022-02-10 - Earliest claimed: 2019-01-16 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Varun Murthy; Jason Roszak; Blake Ryan Watts; Matthew Conover; Arvind Ahuja - Web page: https://patentgrep.com/patent/US20220046050A1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0263: {Rule management} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are various approaches to automate vulnerability assessment implement policy-based mitigation. A plurality of vulnerability records from respective ones of a plurality of vulnerability feeds are aggregated. Each of the plurality of vulnerability records are stored in a standardized format. A plurality of enterprise-specific severity scores are generated by calculating an enterprise-specific severity score for each of the plurality of vulnerability records. Then, a web page can be created that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records. ## Claims ### Claim 1 A system for automatically assessing and mitigating vulnerabilities, comprising: a computing device comprising a processor and a memory; machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least: aggregate a plurality of vulnerability records from a plurality of vulnerability feeds; store the plurality of vulnerability records in the memory in a standardized format; generate a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records; and create a web page that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records. ### Claim 2 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the machine-readable instructions, when executed by the processor, further cause the computing device to at least: identify a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records; select a policy applicable for the at least one of the plurality of vulnerability records; and place the policy in a command queue associated with the client device. ### Claim 3 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to install an update to address the vulnerability. ### Claim 4 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to disable functionality related to the vulnerability. ### Claim 5 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, blocks the client device from access to a network resource until an update to address the vulnerability is installed. ### Claim 6 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the machine-readable instructions that cause the computing device to aggregate the plurality of vulnerability records further cause the computing device to at least: scrape one of the plurality of vulnerability records from a respective one of the plurality of vulnerability feeds; and parse the scraped one of the plurality of vulnerability records for at least one of a vulnerability severity score, vulnerable application information, or vulnerable device information. ### Claim 7 The system of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein calculating the enterprise-specific severity score for each of the plurality of vulnerability records further comprises causing the computing device to at least repeatedly: determine a number of managed devices that are vulnerable to a vulnerability identified in one of the plurality of vulnerability records; determine a vulnerability severity score for the vulnerability; and multiply the number of managed devices that are vulnerable by the vulnerability severity score to calculate the enterprise-specific severity score. ### Claim 8 A method for automatically assessing and mitigating vulnerabilities, comprising: aggregating a plurality of vulnerability records from a plurality of vulnerability feeds; storing the plurality of vulnerability records in a standardized format; generating a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records; and creating a web page that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records. ### Claim 9 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, further comprising: identifying a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records; selecting a policy applicable for the at least one of the plurality of vulnerability records; and placing the policy in a command queue associated with the client device. ### Claim 10 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to install an update to address the vulnerability. ### Claim 11 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, causes the client device to disable functionality related to the vulnerability. ### Claim 12 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein the policy, when retrieved by the client device from the command queue, blocks the client device from access to a network resource until an update to address the vulnerability is installed. ### Claim 13 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein aggregating the plurality of vulnerability records further comprises: scraping one of the plurality of vulnerability records from a respective one of the plurality of vulnerability feeds; and parsing the scraped one of the plurality of vulnerability records for at least one of a vulnerability severity score, vulnerable application information, or vulnerable device information. ### Claim 14 The method of claim Error! Bookmark not defined. for automatically assessing and mitigating vulnerabilities, wherein calculating the enterprise-specific severity score for each of the plurality of vulnerability records further comprises: determining a number of managed devices that are vulnerable to a vulnerability identified in one of the plurality of vulnerability records; determining a vulnerability severity score for the vulnerability; and multiplying the number of managed devices that are vulnerable by the vulnerability severity score to calculate the enterprise-specific severity score. ### Claim 15 A non-transitory computer-readable medium comprising machine-readable instructions for automatically assessing and mitigating vulnerabilities that, when executed by a processor, cause a computing device to at least: aggregate a plurality of vulnerability records from a plurality of vulnerability feeds; store the plurality of vulnerability records in a standardized format; generate a plurality of enterprise-specific severity scores by calculating an enterprise-specific severity score for each of the plurality of vulnerability records; and create a web page that includes at least a subset of the plurality of enterprise-specific severity scores and respective ones of the plurality of vulnerability records. ### Claim 16 The non-transitory computer-readable medium of claim Error! Bookmark not defined., wherein the machine-readable instructions for automatically assessing and mitigating vulnerabilities, when executed by the processor, further cause the computing device to at least: identify a client device susceptible to a vulnerability identified by at least one of the plurality of vulnerability records; select a policy applicable for the at least one of the plurality of vulnerability records; and place the policy in a command queue associated with the client device. ### Claim 17 The non-transitory computer-readable medium of claim Error! Bookmark not defined., wherein the policy, when retrieved by the client device from the command queue, causes the client device to install an update to address the vulnerability. ### Claim 18 The non-transitory computer-readable medium of claim Error! Bookmark not defined., wherein the policy, when retrieved by the client device from the command queue, causes the client device to disable functionality related to the vulnerability. ### Claim 19 The non-transitory computer-readable medium of claim Error! Bookmark not defined., wherein the policy, when retrieved by the client device from the command queue, blocks the client device from access to a network resource until an update to address the vulnerability is installed. ### Claim 20 The non-transitory computer-readable medium of claim Error! Bookmark not defined., wherein calculating the enterprise-specific severity score for each of the plurality of vulnerability records further comprises causing the computing device to at least repeatedly: determine a number of managed devices that are vulnerable to a vulnerability identified in one of the plurality of vulnerability records; determine a vulnerability severity score for the vulnerability; and multiply the number of managed devices that are vulnerable by the vulnerability severity score to calculate the enterprise-specific severity score.