In development

Upcoming software

Which known vulnerabilities affect your hosts, and what did you do about them?

RiskPeriscope keeps a package inventory of your systems, matches it against vulnerability advisories, and stores the decisions and evidence you need for audits and regulatory reporting. It runs on your own hardware.

Preview build in internal testing. No release date yet.

RiskPeriscope overview with finding counts, coverage and risk by host
SPDX 2.3
SBOM export and import
Offline
Advisory evaluation from stored feed snapshots
KEV
Shown as its own flag, not as severity
Unknown
Missing data is never shown as secure

Background

Why this exists

More vulnerabilities are being published

The number of published CVEs has grown year over year. Automated and AI-assisted vulnerability research is adding to that volume. For an operator, each new entry raises the same questions: is this package installed anywhere, is the advisory relevant to our version, and who decided what to do?

Regulation now asks for evidence

The EU Cyber Resilience Act (Regulation (EU) 2024/2847) adds security and reporting duties for manufacturers of products with digital elements. Organisations following BSI IT-Grundschutz or ISO 27001 need documented scope, checks and risk decisions. In both cases, a scan result alone is not enough; the reasoning and its history have to be kept.

Regulation

CRA dates

Based on published Commission and ENISA material. Check the Official Journal text before relying on it.

EU Cyber Resilience Act
Regulation entered into force
Provisions on conformity assessment bodies apply
Manufacturer reporting duties (Art. 14) apply
Remaining main obligations apply

For actively exploited vulnerabilities, Art. 14 sets an early warning within 24 hours, a notification within 72 hours, and a final report no later than 14 days after a corrective measure is available.

Features

What exists today, and what does not

Labels reflect the state of the preview build. Anything marked as in development or planned may change or be dropped.

Preview works in the internal preview build In development in an isolated branch, not deployed Planned not started
Inventory
Hosts, FreeBSD jails and containers; discovered devices need manual approval; SSH host keys are pinned.
Preview
SBOM
SPDX 2.3 JSON generated from the package database; import of SPDX 2.2 and 2.3; comparison between snapshots.
Preview
Vulnerability matching
Offline evaluation against FreeBSD VuXML, with the CISA KEV list as a separate exploitation flag. Feed files are imported by an operator and stored as hashed snapshots.
Preview
Package search
Find a package across all hosts and see which snapshots were actually evaluated.
Preview
Records
Per-finding acknowledgement, exception register, hash-chained audit log, evidence export.
Preview
CRA
Product records and reporting cases that track the Art. 14 deadlines.
In development
BSI IT-Grundschutz
Scope and target modelling, requirement checks with a second reviewer, risk treatment, governance and continuity records.
In development
Other platforms
Package matching beyond FreeBSD. Today, other systems can only be added by SBOM import and are shown as not evaluated.
Planned

Screenshots

The interface

Taken from the preview build with demo data. Hostnames are placeholders. Select an image to enlarge it.

Findings. Severity is only shown when a CVSS source exists; KEV is a separate flag.
Package search across all hosts, based on the newest inventory of each.
Advisory feed snapshots and evaluation runs.
Asset detail with top findings and evaluation state.

Principles

Design choices

  • Missing data is shown as unknown. A host without an evaluated inventory is never reported as secure.
  • No overall compliance score. Scan results, process checks and reviews are reported separately.
  • Limited privileges. Collection runs through a small broker with its own policy; the web application holds no host credentials.
  • Self-hosted. Django and PostgreSQL on your own server. Evaluation works without internet access.

Progress

Development log

Summarised from the commit history.

  1. First internal deployment with severity and KEV kept separate. Project renamed to RiskPeriscope.

  2. Jail and container discovery, broker-based package collection, host key pinning, exception register, audit log and evidence export. New user interface.

  3. Concept for CRA and BSI IT-Grundschutz support written; offline assessment foundation started.

  4. CRA product records and reporting deadlines; Grundschutz scope and target modelling, risk treatment, continuity and governance records.

  5. Scope reconciliation and requirement checks with independent review.

  6. Compliance modules running on a separate test instance next to the preview.