Internal scanning identifies risks reachable from trusted networks. External assessment identifies what a potential attacker can reach from the public Internet.

inSight Vulnerability Management assesses authorized public-facing assets for conditions such as:

• Exposed network services

• Outdated or vulnerable software

• Weak encryption protocols and certificates

• Insecure remote-access services

• Unexpected administrative interfaces

• Misconfigured web applications and services

• Changes to the municipality’s external attack surface

Internal and external assessments provide complementary views of risk. Neither should be treated as a substitute for the other.

A vulnerability management program is only effective when the agency knows which systems should be assessed.

Trestle reconciles scan results against available authoritative sources, which may include:

• Active Directory

• inSight Monitoring

• Endpoint security platforms

• VMware and virtualization inventory

• DHCP, ARP and switch forwarding information

• Firewall objects and network documentation

• Existing municipal asset records

This process helps identify:

• Systems missing from the formal inventory

• Devices that could not be reached during a scan

• Unsupported or obsolete operating systems

• Unmanaged endpoints

• Unknown network devices

• Retired assets that remain connected

• Discrepancies between operational and documented inventory

This strengthens the relationship between vulnerability management and CJIS system-component inventory requirements under CM-8.

Automated scanners can produce hundreds or thousands of findings. They cannot independently determine which vulnerabilities create the greatest operational risk to a police department.

Trestle reviews and prioritizes findings using factors such as:

• Technical severity and CVSS score

• Evidence of active exploitation

• Internet exposure

• Access to Criminal Justice Information

• System criticality

• Availability of patches or mitigations

• Existing security controls

• Operational impact of remediation

• Age of the vulnerability

• Whether the finding has been validated

This allows municipalities to focus limited technical resources on the vulnerabilities most likely to affect public safety, security or CJIS compliance.

Vulnerability management does not end when a scan report is delivered.

inSight Vulnerability Management maintains a structured remediation process that documents:

• Affected system and vulnerability

• Technical severity and operational risk

• Recommended corrective action

• Assigned responsible party

• Target remediation date

• Current remediation status

• Technical or operational dependencies

• Approved exceptions

• Compensating controls

• Rescan results and closure evidence

Remediated findings are rescanned whenever practical to verify that the vulnerability is no longer present.

Findings that cannot be immediately corrected remain visible until resolved, mitigated or formally accepted. This supports CJIS RA-5 vulnerability monitoring and SI-2 flaw-remediation tracking.

The vulnerabilities affecting municipal systems continually change as researchers, vendors and government agencies disclose new security weaknesses.

Trestle maintains current scanning content and adjusts the assessment program when:

• New critical vulnerabilities are announced

• A vulnerability is known to be actively exploited

• Significant new systems are deployed

• Major operating-system or application changes occur

• New attack techniques affect existing infrastructure

• Security advisories identify potentially vulnerable products

Where appropriate, Trestle can perform targeted out-of-cycle assessments to determine whether a newly disclosed vulnerability affects the customer environment.

This supports RA-5(2), which requires agencies to update the vulnerabilities being assessed as new vulnerabilities are identified.

inSight Vulnerability Management reports are designed for action and oversight—not simply to reproduce raw scanner output.

Recurring reports may include:

• Executive summary of current risk

• Asset and scan-coverage statistics

• Critical and high-priority vulnerabilities

• Newly discovered findings

• Outstanding findings by age

• Remediation progress

• Overdue corrective actions

• Accepted risks and compensating controls

• Systems that could not be authenticated or reached

• Verification-scan results

• Trends across reporting periods

• CJIS control alignment

Technical details remain available for administrators, while concise management reporting helps police leadership and municipal officials understand exposure, progress and required decisions.

CJIS readiness requires agencies to demonstrate that vulnerabilities are identified, reviewed and addressed through an established process.

inSight Vulnerability Management helps maintain repeatable evidence such as:

• Approved scan scope

• Asset and network coverage records

• Scan schedules and completion history

• Authenticated-scan status

• Vulnerability reports

• Review and prioritization records

• Remediation tickets

• Exception and risk-acceptance documentation

• Rescan and closure evidence

• Periodic management reports

This is the difference between “we ran a scan” and “we operate a vulnerability management program.”