Vornin
Vornin provides a continuous vulnerability management platform that unifies scanning across attack surfaces, web apps, APIs, networks, code, containers, and cloud into a single deduplicated record. The platform ranks findings by real-world exploitability using EPSS and CISA KEV data, tracks remediation SLAs with automatic escalation, and maintains a SHA-256 hash-chained tamper-evident audit trail for compliance verification. It maps every finding to nine compliance frameworks including NIS2, DORA, ISO 27001, and SOC 2.
- Cybersecurity
- Software Only
- Regulatory & Compliance Technology
- Artificial Intelligence
Funding
Founders
Founder details are not available yet.
Product
Problem
Most vulnerability scanners produce noisy, duplicate findings lists sorted by severity and provide no ongoing tracking of remediation, leaving security teams unable to demonstrate actual risk reduction. Without persistent records and verified fixes, organizations struggle to prove compliance and audit readiness.
Solution
Vornin provides a continuous attack-surface monitoring platform that manages the full vulnerability lifecycle on a single record—from scanning web apps, APIs, networks, code, containers, and cloud to driving fixes to verified closure with tamper-evident audit evidence. The platform ranks findings by real-world exploitability using EPSS and CISA KEV data, supplies AI-reviewed everyday-language remediation guidance, and tracks remediation SLAs with automatic escalation when deadlines slip. Scans automatically re-test and close findings once vulnerabilities are resolved, while all events remain hash-chained (SHA-256) so teams can demonstrate exactly what was found, fixed, and when. The platform integrates directly with Jira, GitHub, GitLab, and Azure DevOps so developers can act without leaving their workflow, and every finding maps to applicable compliance controls across nine frameworks.
Target Audience
Primary customers are small to large organizations preparing for NIS2, DORA, ISO 27001, or SOC 2 audits, including security teams, IT administrators, and compliance officers in EU-regulated industries.
Features
- Unified scanning across attack surface, web apps, APIs, networks, code, containers, Kubernetes, and cloud with one deduplicated findings record per issue
- Risk-based prioritization combining EPSS, CISA KEV, reachability, and severity, ensuring exploited vulnerabilities are never deprioritized
- SHA-256 hash-chained tamper-evident event history for every finding, exportable as per-finding auditor ZIP packs and tenant-wide compliance bundles
- AI-reviewed false-positive filtering on code findings and plain-language fix guidance on every finding
- SLA enforcement with remediation deadlines by severity and automatic email/webhook escalation on breach
- Import capability for Nessus, OpenVAS, CSV, and JSON results to migrate existing vulnerability history
- EU-hosted infrastructure with passwordless authentication, MFA, SAML SSO, and row-level tenant isolation