Cisco Vulnerability Management is a risk-based vulnerability management platform that ingests and normalizes findings from multiple scanners and security tools, applies predictive risk scoring to prioritize remediation, and manages remediation workflows and ITSM integrations.
Published Sep 24, 2026
CVM documentation indicates that the product does not provide explicit metadata.xml, does not encrypt the SAML assertion, and does not sign the SAML request. Organizations with stringent SAML metadata or assertion requirements should validate compatibility.
Public review excerpts indicate operational issues including:
Based on product positioning and review excerpts, likely decision drivers include:
Gartner Peer Insights lists CVM in the Vulnerability Assessment market with an overall rating in the mid‑high range based on a modest number of public ratings at the time of capture. Representative themes on the overview page include real-time management, usability, reporting, and support; full review text may be gated.
Direct CVM-specific user threads are less prominent; broader community discussions focus on Cisco product vulnerabilities and patching urgency (for example, AsyncOS, FMC, SD‑WAN). While not direct CVM reviews, these discussions influence buyer perception for organizations that use multiple Cisco security products.
Vendor materials cite an Omdia RBVM assessment that placed CVM in the analysts' Leader category for the RBVM market.
Critical evaluation:
Most suitable for mid-market to large enterprises with thousands of assets and structured vulnerability management programs.
Common fits include regulated or complex environments such as:
Get a comprehensive analysis of Cisco Vulnerability Management including market position, competitive landscape, adoption trends, and peer benchmarks.
Download full report →Cisco has published an End-of-Sale / End-of-Life (EOL) notice for Cisco Vulnerability Management and related modules. Vendor and competitor materials reference EOL and support milestone dates; these should be validated directly with Cisco sales and official EOL documentation as part of procurement due diligence.
Reported EOL milestones referenced in third-party migration pages include end-of-sale and end-of-support dates. Because competitor materials may be incentivized to accelerate migrations, buyers must confirm dates with Cisco.
Reported churn drivers and migration marketing include:
Note: competitor migration materials may emphasize vendor lifecycle notices to encourage switching; prospective buyers should validate lifecycle dates against vendor communications.
G2 contains a substantial number of reviews based on the public summary at the time of capture.
Examples of positive feedback visible in excerpts:
Examples of negative feedback visible in excerpts:
These operational concerns affect core RBVM value drivers—data quality, correlation, and operational trust in the platform.
Cisco references a Forrester TEI study claiming a substantial ROI and a measurable reduction in breach risk over a multi-year period for a modeled organization.
Critical evaluation:
Cisco Vulnerability Management (CVM)—formerly Kenna.VM—is a risk-based vulnerability management (RBVM) platform that:
Cisco positions CVM as a prioritization and workflow optimization layer intended to help teams determine which vulnerabilities to address first rather than replacing scanners. The vendor cites predictive metrics (for example, claims of high forecasting accuracy) and multiple threat intelligence feeds; these are vendor-provided claims and the underlying methodologies and benchmarks are not fully disclosed in public materials. This report treats such vendor claims as directional and flags the need for validation during procurement and technical evaluation (see "Critical Analysis & Common Complaints").
Official product page: Cisco Vulnerability Management product overview on the vendor website.