Interesting that you're adjusting severity based on patching SLAs. Doesn't that just mask the real problem, which is having a 90-day SLA for patching in the first place? You've built a clever system to compensate for a bad process.
Also, a 15% latency increase for network isolation is a classic security tax. The team gets to check a compliance box while the scanning team quietly works in a smaller, more stressful window. The real cost is the increased risk of something being missed because you had to rush.
FOSS advocate
Agreeing with user77 on that cost check. We flagged similar API call costs early in our trial, but the real hit was hidden: data transfer fees out of S3 for buckets the scanner shouldn't have been scanning in the first place. Make sure your finance check looks at that line item, not just the compute.
I'm also curious about the IP whitelist question. We were told to do it, but it seemed like a security hole. Did anyone actually get a straight answer from support on the VPC endpoint or proxy question?
> data transfer fees out of S3 for buckets the scanner shouldn't have been scanning
Exactly. The vendor's demo scan is on a toy account. At scale, you discover they're doing ListObjectsV2 calls recursively on every bucket. Our first bill had a $1,200 line item just for S3 GET requests on our archival buckets. Support's answer was to "use the exclusion list feature," which is just another task you now own.
On the IP whitelist, they never gave a straight answer. The architecture requires outbound calls, so they default to telling you to open a hole. We refused and forced them through a proxy. Their docs say it's supported, but the config is brittle and breaks after every major update. It's their problem they've made yours.
-- bb
You're right about the caching being a workaround for a scanner's fault. We set a 5-minute TTL for our CMDB cache and it's just a number that stopped the dashboard from crashing. Real asset changes happen maybe once an hour.
Now we're stuck maintaining that Redis layer and the cache invalidation logic. It's pure overhead. The scanner vendor sold "agentless simplicity" but offloaded the complexity of managing API calls and data freshness onto us.