OpenVAPTCoverage Dashboard
What OpenVAPT assesses, organised the way professional assessments report: by control category and severity, and mapped to CIS Controls v8 safeguards, NIST CSF 2.0 subcategories, OWASP Top 10 and the OWASP Web Security Testing Guide v4.2.
Checks
310
Control Categories
10
CWE Weaknesses
85
OWASP WSTG v4.2 Tests
19
NIST 800-53 Controls
63
Checks by Category and Severity
Severity is the rating a check carries when it fails, on the CVSS v3.1 qualitative scale.
View as Table
| Category | Critical | High | Medium | Low | Info | Total |
|---|---|---|---|---|---|---|
| Identity and Authentication | 3 | 8 | 13 | 12 | 2 | 38 |
| Access Control | 0 | 18 | 7 | 6 | 0 | 31 |
| Patch and Vulnerability Management | 1 | 9 | 3 | 4 | 2 | 19 |
| Secure Configuration | 2 | 5 | 19 | 54 | 4 | 84 |
| Cryptography and TLS | 0 | 7 | 14 | 2 | 0 | 23 |
| Logging and Monitoring | 0 | 0 | 1 | 22 | 0 | 23 |
| Network Exposure | 2 | 6 | 4 | 1 | 2 | 15 |
| Data Services | 4 | 8 | 4 | 1 | 0 | 17 |
| Web Application Security | 1 | 1 | 10 | 4 | 1 | 17 |
| Information Exposure | 1 | 11 | 14 | 17 | 0 | 43 |
Severity Heat Map
View as Table
| Category | Critical | High | Medium | Low | Info | Total |
|---|---|---|---|---|---|---|
| Identity and Authentication | 3 | 8 | 13 | 12 | 2 | 38 |
| Access Control | 0 | 18 | 7 | 6 | 0 | 31 |
| Patch and Vulnerability Management | 1 | 9 | 3 | 4 | 2 | 19 |
| Secure Configuration | 2 | 5 | 19 | 54 | 4 | 84 |
| Cryptography and TLS | 0 | 7 | 14 | 2 | 0 | 23 |
| Logging and Monitoring | 0 | 0 | 1 | 22 | 0 | 23 |
| Network Exposure | 2 | 6 | 4 | 1 | 2 | 15 |
| Data Services | 4 | 8 | 4 | 1 | 0 | 17 |
| Web Application Security | 1 | 1 | 10 | 4 | 1 | 17 |
| Information Exposure | 1 | 11 | 14 | 17 | 0 | 43 |
Checks by Domain
View as Table
| Checks by Domain | Checks |
|---|---|
| Server | 168 |
| Network | 50 |
| Web Apps | 92 |
| Total | 310 |
Checks by Severity
View as Table
| Checks by Severity | Checks |
|---|---|
| Critical | 14 |
| High | 73 |
| Medium | 89 |
| Low | 123 |
| Info | 11 |
| Total | 310 |
Framework Coverage
CIS Critical Security Controls v8
Checks per safeguard. Each check counts only toward the safeguard it maps itself, not toward the whole control. Safeguard ids with short paraphrased names; no CIS text is reproduced.
View as Table
| Checks per CIS Safeguard | Checks |
|---|---|
| CIS 2.2 Supported software only | 5 |
| CIS 2.5 Allow-listed software sources | 1 |
| CIS 3.3 Data access control lists | 51 |
| CIS 3.10 Encrypt data in transit | 23 |
| CIS 4.1 Secure configuration process | 75 |
| CIS 4.3 Session locking on idle | 1 |
| CIS 4.4 Firewall on servers | 6 |
| CIS 4.7 Manage default accounts | 1 |
| CIS 4.8 Remove unneeded services | 24 |
| CIS 5.2 Unique, strong passwords | 23 |
| CIS 5.3 Disable dormant accounts | 1 |
| CIS 5.4 Restrict administrator privileges | 5 |
| CIS 7.3 Automated operating system patching | 8 |
| CIS 7.4 Automated application patching | 5 |
| CIS 8.2 Collect audit logs | 11 |
| CIS 8.3 Adequate audit log storage | 4 |
| CIS 8.4 Standardised time synchronisation | 1 |
| CIS 8.5 Detailed audit logs | 5 |
| CIS 8.9 Centralised audit logs | 1 |
| CIS 16.2 Accept and handle vulnerability reports | 1 |
| CIS 16.7 Hardened application infrastructure templates | 58 |
| Total | 310 |
NIST Cybersecurity Framework 2.0
Checks per CSF subcategory, from each check's own mapping. A check can support more than one subcategory.
View as Table
| Checks per NIST CSF Subcategory | Checks |
|---|---|
| DE.CM-09 Computing hardware, software and data are monitored | 1 |
| ID.RA-01 Vulnerabilities in assets are identified | 18 |
| ID.RA-08 Vulnerability disclosures are received and handled | 1 |
| PR.AA-01 Identities and credentials are managed | 25 |
| PR.AA-05 Access permissions follow least privilege | 56 |
| PR.DS-01 Data at rest is protected | 51 |
| PR.DS-02 Data in transit is protected | 23 |
| PR.IR-01 Networks are protected from unauthorised access | 30 |
| PR.PS-01 Configuration management practices are applied | 158 |
| PR.PS-02 Software is maintained, replaced and removed | 18 |
| PR.PS-04 Log records are generated | 22 |
| PR.PS-05 Unauthorised software is prevented | 1 |
| Total | 404 |
OWASP Top 10 (2021)
View as Table
| Checks per OWASP Top 10 Category | Checks |
|---|---|
| A01:2021 Broken Access Control | 9 |
| A02:2021 Cryptographic Failures | 31 |
| A03:2021 Injection | 2 |
| A04:2021 Insecure Design | 1 |
| A05:2021 Security Misconfiguration | 100 |
| A06:2021 Vulnerable and Outdated Components | 21 |
| A07:2021 Identification and Authentication Failures | 23 |
| A08:2021 Software and Data Integrity Failures | 3 |
| A09:2021 Security Logging and Monitoring Failures | 18 |
| Total | 208 |
Control Categories
Each category also points to the CIS controls and CSF categories it broadly relates to. This is orientation only; the charts above use each check's own safeguard mapping.
| Category | What It Covers | CIS Controls v8 (Broad) | NIST CSF 2.0 (Broad) |
|---|---|---|---|
| Identity and Authentication | Accounts, passwords, keys, privilege escalation paths and login controls. | 5, 6 | PR.AA |
| Access Control | File, directory and system permissions that decide who can read or change what. | 3, 6 | PR.AA, PR.DS |
| Patch and Vulnerability Management | Supported releases, pending security updates and outdated components. | 7, 2 | ID.RA, PR.PS |
| Secure Configuration | Operating system and service hardening settings. | 4 | PR.PS |
| Cryptography and TLS | Protocol versions, ciphers, certificates and key protection. | 3 | PR.DS |
| Logging and Monitoring | Log persistence, auditing, time synchronisation and monitoring readiness. | 8 | PR.PS, DE.CM |
| Network Exposure | What the machine exposes to the network and how it is filtered. | 4, 12, 13 | PR.IR, PR.PS |
| Data Services | Databases, caches, file shares, mail and DNS services and their access controls. | 3, 4, 12 | PR.DS, PR.PS |
| Web Application Security | Browser-enforced protections, cookies, cross-origin rules and transport security. | 16 | PR.PS, PR.DS |
| Information Exposure | Files, versions, errors and secrets that a website or server reveals. | 3, 16 | PR.DS |
OWASP Web Security Testing Guide v4.2
Web checks that implement, in automated and read-only form, part of these WSTG tests. Full WSTG testing includes manual and active techniques that OpenVAPT deliberately does not perform.
Coverage shows what OpenVAPT checks, not that a system meets any framework. Passing every check is not a certification or a compliance statement. See What It Does Not Do.