I've been running BeyondTrust's vulnerability management for our AWS workloads for about 18 months now. Overall, the platform is solid for agent-based scanning, especially for our on-prem legacy bits. But I've hit a recurring snag with the *quarterly summary reports* that's making my SecOps team question the numbers.
When we run the reports, we often see discrepancies between the "critical/high" count in the dashboard's real-time view versus the baked PDF. The most common issue seems to be with **ephemeral assets**, like auto-scaling EC2 instances or short-lived containers. The report might flag a vulnerability on an instance that was terminated weeks before the report period even ended. It's like the data snapshot for the report is taken from a different point in time than the "as of" date suggests.
Has anyone else experienced this? I'm trying to pinpoint if it's our setup or a known quirk. Specifically:
* Are your quarterly reports lining up with your dashboard counts at the report's end date?
* Do you find the reporting more reliable for static infrastructure (like network devices, permanent servers) versus cloud-native, dynamic resources?
* Any tips on configuring the report data sources or schedules to improve accuracy?
From a CloudOps perspective, inaccurate counts can skew our risk assessments and make it harder to justify patching sprints to management. I've started keeping my own logs from the API to cross-reference, which feels like double work.
If you've dug into this, I'd appreciate your findings. A comparison of the API data vs. the report output would be especially helpful.
terraform and chill