Proof of fix: show clients what you fixed since the last scan

The work your team did is invisible

Every month you patch, rescan and send the client a report. And every month the report shows a long list of what is still wrong, while the work your team did is invisible. Proof of fix changes that. Varaxon Scan Hub reports now include a Since the last scan section that names what your team fixed.

What the client sees

At the top of the section are five numbers: fixed, new, reopened, still open and not rechecked. Still-open issues are also split by priority band. Below that are the lists:

• Fixed since the last scan. Each issue by name, with its priority band, a KEV tag if it is on the CISA Known Exploited Vulnerabilities list, and the systems it was fixed on.
• Back since the last scan. Issues that were fixed before and have returned.
• New since the last scan. Issues this scan found for the first time.

So instead of "we did some patching", the client reads "Zerologon fixed on dc01, OpenSSH fixed on three servers". That is the conversation you want to have at renewal. The numbers come straight from comparing the two scans. AI does not write or guess them.

When it won't mark something fixed

A wrong "fixed" is worse than no proof at all, so Scan Hub is careful:

• The rescan didn't log in. If last month's scan logged in to a system and this month's didn't, issues that need a login to see were not looked for. They show as not rechecked and stay open until a logged-in scan checks again. See credentialed vs non-credentialed scans.
• A different scanner. Scanners name and check issues differently, so a Nessus scan is never compared with a Qualys scan. The comparison starts with the next scan from the same scanner.
• The scanner isn't named. An export that doesn't say which scanner made it is not compared, and nothing is marked fixed.
• A system is missing. If a system from last time isn't in this scan, its issues are not counted as fixed or still open. Some sources, such as Defender pulls and some CSV exports, list only systems that still have findings, so the report says so.

How to use it each month

1. Scan the client with the same scanner and settings as last month. Use a logged-in (credentialed) scan if you can.
2. Upload the export, or let the Defender or ConnectSecure connection build the report.
3. Send the PDF. The fixed list is your proof of work. The new and reopened lists are next month's plan.

Proof of fix works with Nessus, Qualys, Rapid7, Greenbone/OpenVAS, Nuclei, Microsoft Defender and the other scanners Scan Hub reads. Your first three reports are free, with no card needed. Create an account or see sample reports.

Common questions