From Projects to cybersecurity decisions,
VAST keeps the product at the center.
VAST starts by structuring what the organization needs to secure: its Projects, products and equipment. Each product is represented by a living Asset whose technical knowledge is built and maintained over time.
Organize cybersecurity around your product portfolio.
Projects provide the working structure. They group Assets and help teams keep a clear organization as the number of products, variants and versions grows. From the portfolio view, users can move into a Project and then into the Asset they need.
This matters for manufacturers managing more than one isolated product — several product lines, generations or customer variants. Teams keep a global view while still working precisely on one specific piece of equipment.
à intégrer
Build technical product knowledge that can actually be used.
Asset Manager maintains the identity and state of the product, while Asset Inventory describes what the product really contains. This knowledge is not limited to software: it covers Hardware, Software and SBOM, Accounts, Data, Business Apps, Interconnections, Tools and Update mechanisms.
Information can be enriched over time. An SBOM may provide part of the software composition, then the team adds the context needed to understand usage, relationships and where each element sits in the product.
The goal is to create a technical foundation rich enough to be used across VAST, not simply a component catalog.
à intégrer
Understand how product elements depend on each other.
A product is not a collection of separate lists. Software runs on hardware, Business Apps use software components and accounts, data is processed and stored, and Interconnections describe how product functions communicate with their environment.
VAST keeps the useful relationships between these elements. This structure helps teams explore the product, find dependencies and place information back into technical context. When a component becomes a concern, teams can understand faster where it is used and which parts of the product deserve attention.
à intégrer
Keep the difference between what was true yesterday and what is true today.
Products evolve through versions and revisions. Cybersecurity therefore needs to know which technical state supported a given decision. VAST keeps that continuity instead of overwriting old knowledge with every release.
Teams can understand how the product evolved, identify relevant changes and keep assessments or decisions connected to the right context. Versioning becomes a cybersecurity capability in its own right, because a decision without a product version quickly becomes ambiguous.
à intégrer
Search inside one Asset. Understand the impact across the portfolio.
Once product knowledge is structured, it becomes searchable. Teams can search for a library, component, CVE, technology, supplier or another characteristic and find the Assets and versions that match.
This multi-Project, multi-Asset search is especially valuable when an external issue appears: a zero-day, compromised component, end-of-support notice, license change or supplier problem. Instead of asking every team to check its product manually, VAST gives the organization a common starting point to understand the scope.
à intégrer
Move from a known vulnerability to a decision understood in product context.
VAST connects vulnerabilities to the relevant components, Assets and versions. Teams can then assess their relevance in the real product context, document exploitability, follow actions and keep the decision over time.
VEX becomes the documented outcome of contextual analysis, not just an isolated imported or entered status. The history also helps explain why a conclusion was made and whether it should be reviewed when the product or available information changes.
à intégrer
Put threat knowledge to work for the product.
VAST Threat Engine helps identify relevant threats by using the product context. The platform can use VAST knowledge, recognized sources such as MITRE ATT&CK and threat catalogs specific to the organization.
Users benefit from the result without managing the internal complexity of the engine. The public message intentionally stays at this level: VAST brings threat knowledge and product knowledge together to support analysis.
à intégrer
Assess risk with a product that is already understood, then keep the assessment connected to its context.
VAST Risk Assessment uses information already available in the Asset and related analyses instead of asking the analyst to rebuild a new product snapshot. Protected assets, feared events, threats, scenarios, impacts, controls and decisions can stay connected to the right product and version.
When important information changes, VAST helps identify what may deserve another review. Automation helps detect and prepare; the risk decision remains traceable and under human responsibility.
à intégrer
One platform, several levels of visibility.
VAST views let users move from the portfolio to a Project, from the Project to an Asset, and from the Asset to detailed information. A manager can see priority issues, a Product Security team can follow vulnerabilities and shared dependencies, and an Asset Manager can maintain the technical knowledge of a product.
Indicators should always lead back to their source. VAST therefore focuses on visibility and drill-down rather than a global score that cannot be explained.
à intégrer
Produce evidence from knowledge that is already maintained.
VAST reports use the Assets, versions, assessments, vulnerabilities, decisions and treatments already present in the platform. Teams do not need to manually rebuild the product story for every customer request, audit or regulatory milestone.
Reports can remain connected to the context in which they were generated, making it clear which product and version they describe.
à intégrer
Share what is needed without exposing all internal product knowledge.
Product cybersecurity information is sensitive. VAST can prepare views or documents for the intended audience, giving a customer, integrator, partner or auditor the information they need without automatically exposing the complete Asset detail.
Share the ingredients, not the recipe.
à intégrer
SaaS when simplicity matters. On-Premises when control of the environment is required.
Product architectures, SBOMs, vulnerability information and risk assessments can be highly sensitive. VAST can be used as SaaS or deployed On-Premises depending on the organization's security, confidentiality, sovereignty and integration requirements.
à intégrer
Ready to govern your product cybersecurity?
Discover how VAST fits your context. A demonstration is worth more than a long speech.