Automated information association and reporting

A computer-implemented method comprising:

• identifying at least a first vulnerable device, from a plurality of scanned devices, based on vulnerability information received, wherein the plurality of scanned devices were scanned in response to at least one of a user initiating a scan, an automated scan being initiated, a periodic scan being performed, or a continuous scan being performed, wherein the vulnerability information includes device identification information for one or more vulnerable devices, and wherein the first vulnerable device includes one or more of the following conditions:
• is susceptible to contracting one or more computer viruses;
• has a computer virus;
• has deficient anti-virus software;
• or does not have current patches for an operating system;
• receiving, from the first vulnerable device, user information identifying at least one user of the plurality of scanned devices, wherein the user information identifying the at least one user of the plurality of scanned devices comprises information uniquely identifying a user who has utilized the first vulnerable device, and wherein the user who has utilized the first vulnerable device is at least one of an owner of the first vulnerable device, an administrator of the first vulnerable device, or a user of the first vulnerable device;
• storing the user information identifying the at least one user of the plurality of scanned devices;
• associating the user information with the vulnerability information of the first vulnerable device;
• storing the association between the vulnerability information and the user information;
• periodically updating the user information identifying the at least one user of the plurality of scanned devices to reflect one or more potential changes in the user information or the device identification information;
• determining, by a computer, a historical trend from the vulnerability information and associated user information, the historical trend indicating a number of times one or more users have been associated with the first vulnerable device over a predetermined time period comprising one or more months;
• displaying the historical trend;
• determining whether the number of times the one or more users have been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds a first predetermined threshold;
• and
• responsive to determining that the number of times the one or more users have been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds the first predetermined threshold:
• blocking external network access to the first vulnerable device;
• sending the one or more users a notification indicating that a vulnerability associated with the first vulnerable device has been detected, the notification comprising instructions extracted from a knowledge base for remedying the vulnerability associated with the first vulnerable device;
• determining whether the one or more users have been identified as being associated with one or more vulnerable devices a number of times that exceeds a second predetermined threshold;
• and
• responsive to determining that the one or more users have been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold:
• identifying the one or more users as repeat offenders;
• blocking external network access to said one or more users;
• and
• sending the one or more users an additional notification, the additional notification indicating that the one or more users have been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold.

An apparatus comprising:

• a processor;
• and
• memory storing computer readable instructions that, when executed by the processor, cause the apparatus to perform a method comprising:
• receiving vulnerability information identifying a first vulnerable device from a plurality of scanned devices, wherein the plurality of scanned devices were scanned in response to at least one of a user initiating a scan, an automated scan being initiated, a periodic scan being performed, or a continuous scan being performed, wherein the vulnerability information includes device identification information of the first vulnerable device, and wherein the first vulnerable device includes one or more of the following conditions:
• is susceptible to contracting one or more computer viruses;
• has a computer virus;
• has deficient anti-virus software;
• or does not have current patches for an operating system;
• receiving, from the first vulnerable device, user information identifying a user associated with the device identification information, wherein the user information identifying the user associated with the device identification information comprises information uniquely identifying a user who has utilized the first vulnerable device, and wherein the user who has utilized the first vulnerable device is at least one of an owner of the first vulnerable device, an administrator of the first vulnerable device, or a user of the first vulnerable device;
• storing the user information identifying the user associated with the device identification information;
• associating the identified first vulnerable device with the user associated with the device identification information by cross-referencing the user information and vulnerability information;
• storing the association between the vulnerability information and the user;
• periodically updating the user information identifying the user associated with the device identification information to reflect one or more potential changes in the user information or the device identification information;
• determining a historical trend from the vulnerability information and associated user information, the historical trend indicating a number of times the user has been associated with the first vulnerable device over a predetermined time period comprising one or more months;
• determining whether the number of times the user has been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds a first predetermined threshold;
• and
• responsive to determining that the number of times the user has been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds the first predetermined threshold:
• blocking external network access to the first vulnerable device;
• sending the user a notification indicating that a vulnerability associated with the first vulnerable device has been detected, the notification comprising instructions extracted from a knowledge base for remedying the vulnerability associated with the first vulnerable device;
• determining whether the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds a second predetermined threshold;
• and
• responsive to determining that the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold:
• identifying the user as a repeat offender;
• blocking external network access to said user;
• and
• sending the user an additional notification, the additional notification indicating that the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold.

One or more non-transitory computer readable media storing computer readable instructions that, when executed by a processor, cause the processor to perform a method comprising:

• receiving vulnerability information identifying a first vulnerable device from a plurality of scanned devices, wherein the plurality of scanned devices were scanned in response to at least one of a user initiating a scan, an automated scan being initiated, a periodic scan being performed, or a continuous scan being performed, wherein the vulnerability information includes device identification information of the first vulnerable device, and wherein the first vulnerable device includes one or more of the following conditions:
• is susceptible to contracting one or more computer viruses;
• has a computer virus;
• has deficient anti-virus software;
• or does not have current patches for an operating system;
• receiving, from the first vulnerable device, user information identifying a user associated with the device identification information, wherein the user information identifying the user associated with the device identification information comprises information uniquely identifying a user who has utilized the first vulnerable device, and wherein the user who has utilized the first vulnerable device is at least one of an owner of the first vulnerable device, an administrator of the first vulnerable device, or a user of the first vulnerable device;
• storing the user information identifying the user associated with the device identification information;
• associating the identified first vulnerable device with the user associated with the device identification information by cross-referencing the user information and vulnerability information;
• storing an association between the vulnerability information and the user;
• periodically updating the user information identifying the user associated with the device identification information to reflect one or more potential changes in the user information or the device identification information;
• generating a historical trend of the stored association, vulnerability information and user information, the historical trend indicating a number of times the user has been associated with the first vulnerable device over a predetermined time period comprising one or more months;
• determining whether the number of times the user has been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds a first predetermined threshold;
• and
• responsive to determining that the number of times the user has been associated with the first vulnerable device over the predetermined time period comprising the one or more months exceeds the first predetermined threshold:
• blocking external network access to the first vulnerable device;
• sending the user a notification indicating that a vulnerability associated with the first vulnerable device has been detected, the notification comprising instructions extracted from a knowledge base for remedying the vulnerability associated with the first vulnerable device;
• determining whether the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds a second predetermined threshold;
• and
• responsive to determining that the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold:
• identifying the user as a repeat offender;
• blocking external network access to said user;
• and
• sending the user an additional notification, the additional notification indicating that the user has been identified as being associated with one or more vulnerable devices a number of times that exceeds the second predetermined threshold.