Open Source Vulnerability Management: What You Can Run Yourself Before a SOC 2 or ISO 27001 Audit

What is open source vulnerability management?

Vulnerability management is the loop that runs after detection: collect findings from every scanner, remove duplicates, rank them, give each one an owner and a deadline, fix or accept it, and keep the proof. Open source vulnerability management builds that loop from free tools you host yourself, instead of a commercial platform.

The scanners are the easy part, and we have tested them: open source SCA tools on one repository and open source secret scanners side by side. What they do not give you is a memory. On 3 November 2026 we ran Trivy, Gitleaks and Opengrep on OWASP Juice Shop for our SOC 2 scanning guide: 383 findings in four JSON files, and not one of them carried a commit, an owner, a deadline or a status. The management layer fills that gap.

What do SOC 2 and ISO 27001 ask for?

Neither framework names a tool. SOC 2's criterion CC7.1 asks you to detect new vulnerabilities and your exposure to newly discovered ones. ISO 27001:2022 control A.8.8 asks you to get information on technical vulnerabilities, evaluate your exposure and act. Both leave the deadlines to your own policy, then check you kept them.

The SOC 2 wording, as audit firms reproduce it, asks for "detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities". ISO 27001 Annex A 8.8, Management of technical vulnerabilities, starts with "Information about technical vulnerabilities of information systems in use should be obtained", then asks for an evaluation of exposure and appropriate measures. HighTable, an ISO 27001 consultancy, notes that the standard "does not mandate specific hours": remediation timelines come from a service level agreement you define by severity.

So the auditor reads your policy first, then samples findings and checks each one against it. Our guide to what ISO 27001 and SOC 2 auditors ask when AI agents write the code covers the secure development controls around it, A.8.25 to A.8.29.

Which open source tools cover which part?

Each tool below covers part of the loop, and the register in the middle is the piece that is easiest to skip.

Dependency-Track answers "which of our applications ship a component that just became vulnerable?", and a register answers "what is the status of every finding, from every tool, and is it within its deadline?". DefectDojo is a register you feed with an export from each scanner, while CybeDefend Open Source runs the scanners itself and fills its queue on every run, with no export or import in between.

DefectDojo does not scan: it imports what other tools export, removes duplicates and tracks the status of each finding. It has a free, self-hosted Community Edition under the BSD-3-Clause license and a paid Pro edition, and its repository holds parsers for Trivy, Grype, OSV-Scanner, Gitleaks, Semgrep, SARIF and Dependency-Track, among others.

OWASP Dependency-Track is "an intelligent Component Analysis platform". It "monitors component usage across all versions of every application in its portfolio", consumes and produces CycloneDX SBOMs and VEX, and pulls vulnerability data from the NVD, GitHub Advisories, OSV and others. Version 5.2.1 shipped on 25 October 2026.

OpenCVE covers a gap the other tools leave. It lets you "monitor your vendors and products, receive relevant CVE alerts", routed "to email, Slack or webhooks based on rules you define", with "CVSS, EPSS, and KEV context combined into clear risk signals". It is not an SCA scanner and does not read your lockfiles. Its place is the watch between two scans, and on software that sits outside your repositories: the database engine, the VPN, the CI runner. OpenCVE runs as a cloud service with a free plan, or on your own servers under its license terms, which call for a commercial license for commercial on-premise use.

What does an auditor sample?

An auditor picks findings from the period and follows each one: when it was found, on which commit or asset, who owned it, which deadline your policy set for its severity, and how it closed. A fix needs the change that fixed it. An accepted risk needs a reason, an approver and an expiry date.

Over a SOC 2 Type II period or between two ISO 27001 surveillance audits, that trail has to exist for months, not for the week before the audit. Three records carry that trail:

• The policy: severities, deadlines per severity, who can accept a risk and for how long.
• The register: each finding with its dates, owner, status and link to the scan that produced it.
• The exceptions: each accepted risk with its scope, justification, approver and expiry.

What does running it yourself really cost?

The tools are free. The work is not: hosting and upgrading the register, keeping parsers in step with scanner output, mapping severities to your deadlines, and triaging every week so the register stays true. Each scanner and the register ship their own releases, and someone on your team has to apply them.

That trade is often right for a team with a platform engineer and a few repositories. It gets harder when the number of repositories and the pace of change go up, because the register is only as good as the last triage.

What changes when AI agents write the code?

Coding agents such as Claude Code, Cursor, GitHub Copilot and OpenAI Codex raise the number of changes per week, so findings arrive faster and the register has to keep up. Two records matter more: the scan on each change before merge, and the human who approved the change an agent wrote.

The agent that writes the code can also run the audit. With CybeDefend Open Source, /cybedefend runs the AppSec scanners from the coding agent on each change, then sends the same agent after the flaws they cannot see and has it prove each one with an exploit written as a test. Every finding lands in the queue with the scan that produced it, so the register keeps pace with the agents. The agent can propose the fix too, and the register should still show who reviewed and merged it, because the auditor samples the approval, not the patch. Our SOC 2 guide to scanning and penetration testing shows how one finding moves from the scan on a change to the report for the period.

Where does CybeDefend fit?

CybeDefend Open Source is launching soon, and it is built for the loop this guide describes. One command in your coding agent, /cybedefend, runs a full audit in two layers. First the AppSec scanners, open source, in one docker compose up, with Opengrep, Trivy, Gitleaks and zizmor among them, for code, dependencies, secrets, infrastructure as code, CI/CD and containers. Keep the ones you want and add your own. Then the AI scanner, run by your coding agent. Scanners match patterns. The AI scanner reads what your code is meant to do and finds where it breaks, in business logic, in access rights and in the flaws that only show when the code runs, and it proves each flaw with an exploit written as a test.

Under both layers sits our whole platform, an agentic ASPM, the same one we host today as CybeDefend Cloud. It keeps the register: findings from every scanner in one queue without duplicates, and a security policy written as code that blocks the merge on a critical finding, with each exception scoped, dated, justified and approved by name. Security reports map findings to the OWASP Top 10 and the CWE Top 25, exported in PDF for the auditor or in JSON for a GRC tool. We go through the same exercise ourselves: our SOC 2 Type II audit is in progress. If you are preparing yours, we can walk through it with you. To run the audit on your own code when it opens, join the CybeDefend Open Source waitlist.

Frequently asked questions

Is DefectDojo free?

DefectDojo's Community Edition is open source under the BSD-3-Clause license and free to self-host. DefectDojo also sells a Pro edition, in the cloud or on premises. The Community Edition imports findings, removes duplicates and tracks status; check the editions page for the features you need before you plan around them.

What is the best open source vulnerability management tool?

It depends on the job. Dependency-Track watches components through SBOMs. DefectDojo keeps a register of findings imported from many scanners. OpenVAS scans hosts and networks. CybeDefend Open Source chains the AppSec scanners and an AI scanner run by your coding agent, and keeps one queue under your policies. A common setup for an audit is a set of scanners plus one register.

Does ISO 27001 require vulnerability scanning?

Control A.8.8 does not name scanning. It asks you to obtain information about technical vulnerabilities, evaluate your exposure and take appropriate measures. Regular scanning is the usual way to show the first two, and your policy sets how often.

What are typical vulnerability remediation timelines for ISO 27001?

The standard sets none. You define them in your policy by severity, and the auditor checks that you kept them. HighTable lists a schedule it says auditors widely accept: 48 hours for critical, 7 days for high, 30 days for medium and 90 days for low.

Is OpenCVE a vulnerability scanner?

No. OpenCVE monitors CVE publications for the vendors and products you follow and alerts you by email, Slack or webhook, with CVSS, EPSS and KEV context. It does not read your code or your lockfiles, so it works next to an SCA scanner and does not replace one.

Is CybeDefend open source?

Its open source edition, CybeDefend Open Source, is launching soon: our whole platform, an agentic ASPM, free to run on your own servers. The command /cybedefend chains the open source AppSec scanners and an AI scanner run by your coding agent, and keeps every finding in one queue under your policies. Until it opens, CybeDefend Cloud is the same platform, hosted by us. Join the CybeDefend Open Source waitlist.