Skip to content

How an advisory gets here

You only ever see advisories that have been checked against your systems.

  1. Collect. Four times a day we pull new vulnerabilities from public sources: the US National Vulnerability Database, the CISA list of actively exploited vulnerabilities, GitHub advisories and vendor announcements.
  2. Match. We compare them with what your systems run.
  3. Assess. Each match gets a first assessment. Urgent ones reach our team at once.
  4. Check. Each morning, new matches are checked: the vendor advisory is read and your hosts are inspected read-only. Nothing is changed on your systems. The result is recorded per host.
  5. List. Only now does the advisory appear for you, ready by the start of the working day.
  6. Recheck. Every morning all open advisories are checked again: has a system been patched, has a fix been released, has the list of hosts changed?

What is covered

  • Operating systems and their installed packages
  • Common server software running in containers, such as databases and web servers
  • WordPress core, plugins and themes, where we look after a site
  • Firewalls and managed cloud services, by product

What is not covered

The dependencies inside your own applications, for example npm, Composer or Maven packages, are not scanned. If you need this, talk to your DigitalCreek contact.

Automated checks

The morning checks run automatically with an AI assistant under the responsibility of a named engineer. That is why you may see AI assistant, token of name on an entry. The checks are read-only and never change a system.