Proof pack: evidence of your vulnerability work for audits, insurers and renewals

The question every report leaves open

A vulnerability report says what is wrong today. Auditors, cyber insurers and clients at renewal ask something else: "Show me what you did about it." The answer is usually spread across old reports, tickets and email threads, and someone spends a day pulling it together.

We built the proof pack to answer that question from records Scan Hub already keeps. It has three parts that work together: fix deadlines, risk acceptance and the pack itself.

1. Fix deadlines and the past due list

Each finding Scan Hub tracks gets one due date: its priority band's deadline, counted from when it was first seen, or the CISA KEV due date when that comes sooner.

• Set deadlines once for your whole organization, and give a client its own when its contract says something different.
• Each client's overview shows a Past due list with days late, and how many fixes landed on time in the last 90 days.
• Fix these first shows each finding's due date.
• A fix counts as on time only when the rescan that proved it ran by the due date. Saying it was patched is not enough.

Not sure what deadlines to use? See how to set remediation SLAs.

2. Risk acceptance with an online signature

Some findings won't be fixed: a legacy system, a vendor that hasn't shipped a patch, a cost the client won't pay. That is the client's decision, and it should be written down. In Scan Hub an owner or admin records it with a reason, an optional compensating control and an end date no more than 12 months away. Then either:

• Record an acceptance you already have, from an email or a meeting, or
• Ask the client's contact to sign online. They get a one-time link that lasts 14 days, read the exact wording, and sign by typing their name, or decline.

The wording, the signature and the time are kept together. While an acceptance is in force, the finding stays open (it is never counted as fixed) but it is not past due. You get an email 14 days before it ends, so it is reviewed rather than forgotten. See how to document risk acceptance for what a good acceptance says.

3. The proof pack

Pick a client and a period (the last 30, 90, 180 or 365 days), add a cover note if you like, and Scan Hub builds a white-label PDF from the facts:

• What was fixed and proven by a rescan, on time or late against its deadline.
• What is open, what is past due and what is accepted, with how each acceptance was signed.
• The tickets sent to your PSA and the scans the pack is based on.

Code gathers these facts and freezes them in a facts file. Its SHA-256 is the pack's fingerprint, printed in the PDF. You can download the PDF, a CSV of the lists and the facts file itself, so an auditor can recompute the fingerprint and confirm nothing was changed.

Control map and insurance questions

A pack can map its evidence to CIS Controls v8, NIST CSF 2.0, the HIPAA Security Rule and CMMC Level 2. You choose which. Each row prints the evidence the pack holds for that control, or says plainly that it holds none. No row ever says a control is met: that is the auditor's call, not ours.

You can also tick the questions cyber insurers commonly ask, such as how often you scan, how fast you fix and what is still open. Each answer is the evidence from the pack: scans run, fix deadlines and median days to fix, known-exploited issues, what is past due, accepted risks and tickets.

Where AI fits, and where it doesn't

AI writes one thing: a short cover summary. It works only from the pack's counts and dates, and every number it writes must point to one of those facts, or the summary is rejected. It is not allowed words like compliant, certified or audit-ready. It never receives the client's name, the reasons for an acceptance or who signed it. If its draft fails the checks twice, the pack uses fixed wording instead. The method page says when AI wrote the summary, and you can turn it off for any pack.

Everything else in the pack comes straight from your records. That is what we mean by evidence-led.

How to start

1. Set your fix deadlines in Settings, and a client's own deadlines if they differ.
2. Keep scanning each client with the same settings, so fixes are proven by a rescan. Proof of fix shows the changes in every report.
3. Record risk acceptances as they happen, not the week before the audit.
4. Make a proof pack for the period the auditor, insurer or client asks about.

A proof pack is paid for like a report: from your plan's monthly allowance, then one credit. If a pack fails three times, the credit comes back. Your first three reports are free, with no card needed. Create an account or see pricing.

Common questions