CVE scanning
Isolated Trivy with severity reports.
Security & complianceGA
Secure by design, not by add-on
Every agent has its own identity, every capability its own permission and every action an audit entry; scan vulnerabilities on the host itself.
- Trivy
- CVE scanning
- Audit
- complete trail
- RBAC
- 4 roles
VulnerabilitiesLIVE
| Package | CVE | Severity |
|---|---|---|
| openssl | CVE-2026-0142 | Critical |
| libxml2 | CVE-2026-1188 | High |
| curl | CVE-2026-0921 | Medium |
| zlib | CVE-2025-9113 | Low |
Live
HOW IT WORKS
How it works
- 1
Enable scanning
Trivy installs in isolation on the same server.
- 2
Schedule
Periodic or on-demand scans, results by severity.
- 3
Prioritize
Critical CVEs surface in the overview and notifications.
- 4
Fix safely
Upgrade packages in a maintenance window with approval.
Capabilities
Security & compliance
Agent permissions
Separate Shell, Log, Install and Update.
Roles
Owner, admin, operator and viewer.
Audit
Immutable record of all actions.
No inbound ports
Encrypted outbound connections only.
Identity verification
Fingerprint match before activation.
USE CASES
Use cases
Vulnerability management
One view of CVEs across every server.
Audit and compliance
Every sign-in, role change and operation recorded.
Access control
Owner, Admin, Operator and Viewer roles.
Technical specs
- Scanner
- Trivy (OS packages)
- Roles
- Owner · Admin · Operator · Viewer
- Agent identity
- Dedicated, revocable key
- Transport
- TLS, outbound only
- Audit
- Sign-in, membership, roles, operations, shell
ZERO TRUST
Nothing before approval
A new agent performs no operation until an organization admin approves it, and access can be revoked at any moment.
- Instant revocation
- Maintenance windows for changes
- Security event notifications
FAQ
Frequently asked questions
Where does vulnerability scanning run?
On the same server, in an isolated container.
Can terminal access be disabled?
Yes, per agent.
Does scanning need internet access?
Trivy needs outbound access to fetch its vulnerability database.
Related services
DevOps as a ServiceManaged registry, tunnels, logs and metrics with a self-service consol…Log ExplorerCollect, search and retain logs from all servers and services in one c…Monitoring & metricsLocal Prometheus and Thanos with live charts in the whycloud console; …Secure access (whyctl)whyctl: sign in with your whycloud account and SSH into servers or run…
Turn on your own cloud today
Create an account and connect your first server in under five minutes.