Cisco Vulnerability Management vs. HackerOne

It works well when interfacing with Qualys VM QualysGuard to highlight server vulnerabilities, providing details on the affected packages and programs, along with solutions and links to the provider's websites, so our servers can be kept safe by quickly addressing issues. Because vulnerability scores are assigned, we can prioritize which servers to address first.

Incentivized

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

• Vulnerability tracking
• Risk Meter reporting to pinpoint specific systems or vulnerabilities
• Provides vulnerability scores to see what is high / medium / low urgency

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• The layout of the information could use some improvement.

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

CVM provides a very easy to understand and use interfaces. Dashboards and reporting are compiled nicely when risk meters are created. After initial setup of software cisco onboarding teams do an amazing job going over all areas of this software to provide best overall usability of the product. Against other tools setup and usability is at a higher standard

Incentivized

We run a flavor of multiple products and CVM enhances/complements those tools by pinpointing where the vulnerabilities are at on our network. Intune and Automox being products CVM works well with when its time to patch affected systems. Tenable we used prior to CVM and its product was too complex and clunky and always had issues with asset duplication. CVM simplified vulnerability scanning and made it a lot easier to manage compared to Tenable

Incentivized

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

• Has kept our company safe from exploits.

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized