Know every CVE that threatens your servers.
One script, one API key. Your machines scan themselves with Trivy, send results to the platform, and you get a prioritised, audit-ready vulnerability dashboard in seconds.
No credit card. 14-day trial. Cancel anytime.
That's the start. One command.
What is a CVE?
Every vulnerability in the wild has a unique CVE identifier. The platform enriches each CVE with EPSS exploitation probability, KEV status and CVSS score - so you always know where to focus first.
Common Vulnerabilities and Exposures
A standardised identifier (e.g. CVE-2024-1234) for every publicly known security vulnerability.
National Vulnerability Database
The US government's official registry of CVEs, enriched with CVSS scores and technical details.
Common Vulnerability Scoring System
A 0–10 score measuring vulnerability severity: Critical (9–10), High (7–8.9), Medium (4–6.9), Low (0–3.9).
Exploit Prediction Scoring System
Probability (0–100%) that a vulnerability will be actively exploited in the wild within 30 days.
Known Exploited Vulnerabilities
CISA's list of CVEs with confirmed active exploitation in real attacks. Highest priority for patching.
End of Life
Date after which a vendor stops providing security patches for a software version. Machines still running EOL OS are in the highest risk category.
CVSS Severity scale
A KEV flag overrides any CVSS score - a known-exploited vulnerability demands immediate action regardless of its numeric score.
How it works
No daemons, no containers to maintain. One bash script using Trivy - the industry-standard open source scanner. Data flows to the platform only through your API key. Nothing sensitive ever leaves your machine.
Download the audit script
A single Bash script (secvalis.sh). It auto-installs Trivy if not present. Requires only curl and jq - standard on every Linux server.
Scan happens locally - only results leave the machine
Trivy scans the full rootfs and running Docker containers. What leaves the machine is vulnerability metadata (CVE IDs, package names, versions) plus basic machine data needed to attribute the scan: label, hostname, distribution and its version, agent version, time zone and scan status. Never your actual files, configs or secrets.
Platform analyses and prioritises
Results are enriched with NVD data, EPSS exploitation probability and KEV status in real time. Dashboard shows exactly what needs fixing today vs. what can wait.
API key auth
One key per project. All machines in the project report under it. Revoke anytime.
No agents, no daemons
Cron job or one-shot. Nothing running 24/7.
HTTPS only
All traffic encrypted in transit.
Full visibility into your fleet
From fleet-level overview down to individual CVE details - every screen designed for fast triage.
Built for regulated environments
Generate PDF reports for ISO 27001 and EOL governance in one click - no manual data gathering.
ISO 27001 A.8.8
Vulnerability management process evidence - PDF report covering findings, actions and remediation timelines.
NIS2
Network and Information Security Directive - track your vulnerability posture across the entire fleet, with full audit trail.
EOL Governance
Manage OS End-of-Life risk with migration plans, ownership and risk acceptance - ISO 27001 A.8.9.
ISO 27001 A.5.18
Exportable audit trail - who changed what and when across the account. Accountability evidence for access rights and change management (A.8.32).
The Polish cybersecurity act (KSC) is already in force. Your auditor will ask about vulnerability management - have the evidence ready.
Since 3 April 2026 the amended National Cybersecurity System Act (KSC, implementing the NIS2 directive) covers, according to the Ministry of Digital Affairs, around 38,000 entities in Poland, some 27,000 of them public bodies. One of the mandatory risk-management measures is vulnerability handling and disclosure, and at an audit you have to be able to show that this process works and is documented.
Statutory timeline
39 days to the close of the window for filing an application for entry in the Wykaz KSC (2026-10-03). The window comes from a ministerial announcement and can be changed.
- 3 Oct 2026
Deadline for entry in the register of essential and important entities (self-registration: filing the application; some entities are entered ex officio)
Inventory of machines and vulnerabilities = you know what you have before you declare it.
- 3 Apr 2027
Implementation of risk-management measures (including a vulnerability-handling process)
Continuous scanning, EPSS/KEV prioritisation, statuses and an audit trail = a working, documented process.
- 3 Apr 2028
First cybersecurity audit of essential entities that were not previously operators of essential services (then every 3 years)
Evidence Pack: PDF reports, CSV decision history, SHA-256 manifest - the vulnerability-management evidence in one ZIP.
What Secvalis supports
- Asset and vulnerability inventory - an automatic, always-current registry of machines, packages and CVEs (ISO 27001 A.8.8).
- Documented vulnerability-handling process - every vulnerability has a status, a decision and a deadline; accepted risk has an owner and a justification; nothing gets lost in email.
- Evidence for the auditor - an Evidence Pack on demand: no scramble the week before an audit, just click Export.
- Management accountability - dashboards and recurring reports give leadership a current view of vulnerability status, useful when discharging oversight duties.
Secvalis supports selected requirements of the KSC act and the NIS2 directive in the area of vulnerability management. It does not replace a full ISMS implementation, a compliance audit or legal advice. The scope of your organisation's obligations depends on its classification - verify it with an advisor.
Would a free scanner do the job?
An honest comparison of Trivy on its own, Secvalis and enterprise scanners - including what we are still missing.
Read: is free Trivy enough for NIS2?Latest from the blog
Compliance, vulnerabilities and audit evidence
A NIS2 incident: you have 24 hours. What exactly has to happen
Early warning in 24h, notification in 72h, report in a month. See hour by hour what a well-prepared NIS2 incident report looks like.
- NIS2
- Incidents
- Compliance
An end-of-life system is not technical debt. It's a risk register entry
An end-of-life system gets no patches, so it is a risk decision, not a backlog item. See the three things an auditor must see to accept it.
- End of life
- Risk
- ISO 27001
NIS2 Article 20: the board is accountable for cybersecurity. Personally
NIS2 makes the board personally accountable for cybersecurity. See what proof of oversight means and five questions a board should put to its IT team.
- NIS2
- Board
- Compliance
Simple, transparent pricing
Start free. No credit card required.
STARTER
Small businesses & teams
Includes everything available today and every feature added in the future.
PRO
Growing infrastructure teams
Includes everything available today and every feature added in the future.
BUSINESS
Larger estates & MSPs
Includes everything available today and every feature added in the future.
ENTERPRISE
Unlimited scale, custom SLA
Includes everything available today and every feature added in the future.
All plans include a 14-day free trial. Start today - no credit card required.
Secvalis is in active development - and that's your advantage. Early customers get a direct line to the founder and a real say in what we build next: tell us what you need most, and it goes to the top of the roadmap.
What's on the platform?
Every feature listed below is available in every paid plan - from day one and as the platform grows. You pay for machine slots and retention, not feature unlocks.
CVE scanning via Trivy
One bash script installs Trivy and runs a full scan of the OS, installed packages and running Docker containers. Only CVE metadata leaves the machine - no files, no configs, no secrets.
CVSS · EPSS · KEV enrichment
Every CVE is automatically enriched with its CVSS severity score (0–10), EPSS exploitation probability (%) and CISA KEV flag. Three data sources in one view - so you know where to focus first.
Remediation status tracking
Mark individual CVEs as In Progress, Accepted Risk or Fixed - directly from the machine view. Bulk actions available. Status history is preserved and exportable.
Scan history & trend analysis
Every scan is stored with a delta showing the change vs. the previous scan. Track whether your security posture is improving over time and spot regressions instantly.
ISO 27001 A.8.8 PDF report
One-click PDF report covering the full vulnerability management process: findings, remediation actions and timelines. Ready for external auditors - no manual data gathering.
EOL fleet governance
See which machines run End-of-Life operating systems, how many days remain, who owns the migration, target dates and risk acceptance decisions. ISO 27001 A.8.9 aligned.
PDF & CSV export
Export any machine snapshot or fleet summary to PDF or CSV. CSV follows RFC 4180 with BOM for correct Excel rendering. Every export is audit-ready and can be attached to incident reports.
Evidence Pack (one ZIP for a period)
Generate a single ZIP for any audit period: management, ISO 27001 and EOL PDFs, risk-acceptance and audit-trail CSV, a machine-readable JSON dataset and a SHA-256 manifest. Hand an ISO 27001 / NIS2 auditor one integral package instead of clicking together five separate exports.
Email & Telegram notifications
A scheduled daily digest delivers new CVEs to your inbox or Telegram channel. You choose the hour it is sent, in your account time zone.
AUDITOR role
Invite external auditors or compliance teams as read-only AUDITOR members. They see findings and reports - no access to API keys, billing or configuration.
Full AuditLog
Key actions are recorded: who did what and when. Append-only log, available to the AUDITOR role, exportable to CSV. Useful material when documenting an ISO 27001 or NIS2 process.
Multiple projects in one account
Split machines into separate projects inside one account, each with its own membership and reporting. Useful for MSPs, holding companies or teams with distinct environments.
CVE Translator
CVE descriptions from NVD are in English. The built-in translator renders them in Polish - making triage faster for teams that don't work in English daily.
API & integrations
Project API key, agent audit endpoint and a Prometheus /metrics export - scrape your fleet's vulnerabilities into your own Prometheus and chart them on Grafana.
Incident register
Record security incidents with their timeline, classification and the people involved. NIS2 obliges covered entities to report incidents; the register keeps the material you need to do it, instead of reconstructing it from memory afterwards.
Period lock
Freeze a closed reporting period: the evidence dataset is snapshotted and hashed with SHA-256, so nobody can quietly edit history afterwards. OWNER and ADMIN create the freeze; everyone else only reads it.
Evidence coverage map
See at a glance which requirements already have evidence behind them and which do not - before an auditor finds the gap for you. Available to OWNER, ADMIN and AUDITOR.
Vulnerability management policy
Download a ready Vulnerability Management policy document that matches how the platform actually works. Auditors ask for the written policy, not only for the scan results.
Fix-first priority queue
One ordered list answering the only question that matters on Monday morning: which vulnerability to fix first. Ranked by severity, exploitation probability and KEV status combined, not by CVSS alone.
Assignments and My tasks
Assign a vulnerability to a person and let them open one screen with their own workload. Remediation stops being a shared list nobody owns.
Remediation SLA tracking
Set deadlines for fixing vulnerabilities and track what was fixed on time, what is overdue and what stays out of measurement. The percentage is the number an auditor asks for.
Two-factor authentication (TOTP)
Protect the account itself: TOTP from any authenticator app, recovery codes and trusted devices, plus a one-click sign-out from every device. Enabled per user, in every plan.
Frequently asked questions
Product & scope
How is Secvalis different from Trivy alone?
Trivy is a great scanner - but a scanner gives you a list of CVEs, not a process. Secvalis adds everything an audit and day-to-day work require: a central registry of all machines, prioritisation (CVSS + EPSS + KEV), statuses and decisions with an audit trail, reports for management and auditors, notifications, and history over time. In short: Trivy answers “what is vulnerable on this machine right now”, Secvalis answers “what does the vulnerability-management process across the whole company look like, and how is it documented”.
Which systems are supported?
Linux servers: Ubuntu, Debian, RHEL, CentOS, Rocky Linux, AlmaLinux, Fedora and Alpine, as well as Docker images and containers. Other distributions are detected by Trivy. Windows Server support is on the roadmap - if Windows is critical for you, get in touch; we prioritise the roadmap together with our customers.
Do I have to install an agent?
No. Secvalis is agentless: a single script run on a schedule (cron / systemd timer) that triggers a local scan and sends only the result metadata. No daemons, no permanent process, full control on your side - the script is transparent and you can read it before running it.
What exactly leaves my machine?
Only the metadata needed for vulnerability management: the machine label and host name, the distribution and its version, the agent version, the time zone, the scan status, the list of affected packages with their versions, and the detected CVE identifiers. Never: files, configurations, environment variables, secrets, or user data. We document the full, exact payload specification in our docs.
Can I use Secvalis in an isolated (air-gapped) environment?
Currently no - sending results requires an HTTPS connection to api.secvalis.eu. We are considering a proxy/relay mode for isolated networks; get in touch if you need it.
Data & security
Where is my data stored?
In the European Union - hosting infrastructure OVHcloud (OVH SAS), servers located in Warsaw (Poland, EEA). The full list of sub-processors (including the email delivery provider) is available in our Privacy Policy.
Do you sign a Data Processing Agreement (DPA)?
Yes. The DPA is an integral part of the Terms of Service (fulfilling Art. 28 GDPR) and is concluded electronically at registration. The full text is available at /dpa; on request we make it available for download as a PDF and allow a qualified electronic signature (for clients requiring a signed copy).
How is the Secvalis platform itself secured?
TLS 1.2+ encryption in transit, an append-only log of key user actions (available to the auditor role), two-factor authentication (MFA/TOTP), roles and access control, and per-account data isolation. Backups are encrypted (restic) before being sent to storage - the infrastructure provider has no access to the data in plaintext.
Pricing & account
What happens after the trial ends?
The account enters a 7-day grace period, during which it works normally - we delete nothing, and you have time to decide and export your data. Only after that are machines deactivated (they stop scanning), while the data remains available for viewing and download. You do not add a card at the start, so there is no risk of an automatic charge.
I have 11 servers, and the Starter plan has 10 slots. Do I have to buy a more expensive plan?
Get in touch - we will help you choose a plan or discuss adding individual machine slots above the limit. We do not want you paying for a whole higher plan because of a single machine.
Are features disabled in lower plans?
No. You pay for the number of machines and the data retention length, not for unlocking features. Reports, the Evidence Pack, roles, the API - everything is available in every plan.
NIS2 / ISO / cybersecurity law
Is deploying Secvalis enough for NIS2 / the Polish cybersecurity law (KSC) compliance?
No - and be wary of any tool that claims otherwise. The law requires a whole information security management system (ISMS/SZBI). Secvalis closes one of its mandatory elements: the vulnerability-handling process together with asset inventory and evidence for the auditor.
How does Secvalis map to ISO 27001?
We directly support controls: A.8.8 (management of technical vulnerabilities), A.8.9 (configuration management - package inventory) and A.5.18 (access rights - roles and audit trail within the platform itself). The Evidence Pack is designed so the auditor receives evidence in the format they expect.
Start securing your fleet today
One script. 5 minutes to first scan. No commitment needed.