CPE

CPE is a standardized naming scheme for identifying software, operating systems, and hardware, such as a specific version of Apache on Linux. Vulnerability databases use CPE names to state exactly which products a CVE affects, and scanners match your asset inventory against those names to figure out which vulnerabilities apply to you.

• Tenable Nessus → The standard vulnerability scanner for finding and prioritizing what to patch. A scanner shows you the holes; fixing them is still your team's job.

Affiliate links: the site may earn a commission at no extra cost to you (how this works). No single tool is a silver bullet; treat each as one layer of coverage.