What's new in Varaxon Scan Hub: October 2026

The short version

This month we built the parts that come after the report: proving the work was done, tracking what is late, recording what the client chose not to fix, and handing all of it to whoever asks. We also added a free check that has nothing to do with scanners at all. Here is everything, with links to the full guides.

Free email and domain check

Can someone send email pretending to be you? The free email check answers in about 20 seconds, with no account. It reads SPF, DKIM, DMARC, MTA-STS and the domain's registry record, looks at about 400 lookalike names, and checks up to three suppliers. It grades the domain A to F by fixed rules and lists only the DNS changes that raise the grade.

Inside Scan Hub it runs for each client at no cost, as a white-label PDF with a fingerprint, and a recheck shows the grade before and after your fixes. Read the full guide.

Proof of fix in every report

Each report now has a Since the last scan section: what was fixed, what came back and what is new, system by system, most urgent first. If a rescan didn't log in, issues are marked not rechecked, never fixed. Read the full guide.

Fix deadlines and signed risk acceptance

• Fix deadlines. Every tracked finding has a due date from its priority band, or the CISA KEV due date when that is sooner. Each client has a past due list with days late and an on-time count. You can set deadlines for the whole organization or per client.
• Risk acceptance. When a client won't fix something, record why, any compensating control and an end date, or send their contact a one-time link to sign online. Accepted findings stay open but are not past due, and you are reminded before an acceptance ends.

Proof packs

A white-label PDF of a client's last 30 to 365 days: what was fixed and proven by a rescan, what is open, past due or accepted, the tickets sent and the scans used. It can map that evidence to CIS Controls v8, NIST CSF 2.0 and the HIPAA Security Rule, and answer the questions cyber insurers commonly ask, without ever claiming a control is met. A fingerprint lets anyone confirm the facts weren't changed. Read the full guide.

An In progress page

After you upload a scan or click Build report, you no longer have to go back to the client's page to find it. In progress in the sidebar lists every report, proof pack and email check being built across your team, with its current step and a progress bar, plus what finished in the last 24 hours. The sidebar shows a count while anything is building, and a one-line strip at the top of every page links to it.

More evidence behind every ranking

Scan Hub ranks findings by real-world evidence first, not by severity score alone. Each report now shows more of that evidence:

• CISA KEV decides the top band, and EPSS exploit likelihood moves a finding up and orders findings within each band. See CVSS vs EPSS vs CISA KEV.
• VulnCheck KEV listings are shown next to CISA's, so a CVE reported as exploited elsewhere is not missed.
• End-of-life dates for common software and operating systems, so the report says when no patch is coming and what to move to.
• A What public threat data adds section at the top of the report sums up what this evidence changed.
• For exports that leave CVEs out, Scan Hub now maps the scanner's own check IDs to CVEs. Our second sample report went from no known-exploited matches to 9.

Already in Scan Hub

Scan Hub is scanner-agnostic: upload exports from the network, host and web vulnerability scanners you already run, or connect Microsoft Defender or ConnectSecure. After you review a report, it can push the fixes into ConnectWise PSA or HaloPSA as tickets. Reports are white-label, team members have their own roles with an activity log, and there is a free pre-flight check before you spend anything. Scan Hub is listed on Microsoft Marketplace and the ConnectWise® Marketplace.

We built it for MSPs, and just as much for internal IT, compliance and security teams. Your first three reports are free, with no card needed. Create an account or see sample reports.

Common questions