At a glance

NEXT AI runs continuous vulnerability management: automated daily web-app scans (HostedScan), host/package exposure checks (e.g., AWS Inspector and managed endpoint agent), and a documented remediation SLA (Critical 24h, High 3 days, Medium 1 month, Low best efforts). Findings are tracked to closure with owner assignment, validation before close, and records retained 5 years.

Independent testing: For our annual third-party web app & API test (method, cadence, latest results), see Penetration testing.

Scanning & detection

Web application: Automated scans via HostedScan Security run at least daily; engineers are alerted on detection.
Cloud & hosts: AWS Inspector and an endpoint security agent identify OS/package vulnerabilities and misconfigurations across managed assets.

Triage & SLAs

Severity levels:

Severity level	Description
Low	Low severity vulnerabilities are likely to have very little impact on the business, perhaps because they require local system access.
Medium	Medium severity vulnerabilities usually require the same local network or user privileges to be exploited.
High	High severity vulnerabilities are typically difficult to exploit but could result in escalated privileges, significant data loss, and/or downtime.
Critical	Critical severity vulnerabilities likely lead to root level compromise of servers, applications, and other infrastructure components. If a critical vulnerability cannot be addressed within timelines as defined, an incident response ticket will be opened, documenting what interim remediation has been made.

Remediation timelines: When a vulnerability is detected and verified, the engineering team will remediate vulnerabilities within the SLA depending on the severity. Ownership is assigned; work is tracked in the engineering backlog with due dates. SLA resets on upgrades in severity; no SLA relaxation on downgrades. CRITICAL/HIGH cannot ship to production unresolved without an approved exception.

Context: Pentest findings (if any) follow the same remediation SLAs shown here, details in Penetration testing.

Fix, validate, close

A finding closes only after a fix/mitigation is implemented (or false positive verified) and validated by Security/Reporter. Closure notes record where it was fixed and the targeted prod release date. Evidence is retained for 5 years.

Exceptions (compensating controls)

If a direct fix is not yet feasible, an Exception may be raised with compensating controls, approved by the Security Officer and the asset owner, and linked to the original finding for tracking.

Coordinated disclosure

Security researchers and customers can report issues to security@nextapp.co under NEXT’s Responsible Disclosure Policy; we acknowledge and work to resolve promptly.

Standards alignment:

Practices map to NIST SP 800-40 r4 (enterprise patch/vuln management)
OWASP Vulnerability Management Guide
ISO/IEC 27002:2022 control 8.8 (management of technical vulnerabilities)

FAQ

Q: What are NEXT AI’s remediation SLAs?

Critical 24h, High 3 days, Medium 1 month, Low best efforts—applied from time of identification (or reset when severity is upgraded).

Q: Which scanners does NEXT AI use? Are scans really continuous?

Hosted app scans run daily via HostedScan Security; infrastructure/package exposure is checked with AWS Inspector and a managed endpoint agent.

Q: How does NEXT AI track and close findings?

Each finding is assigned an owner, fixed or mitigated, then validated before close; closure notes include the target prod release. Records are kept 5 years.

Q: What if a fix isn’t immediately possible?

An Exception can be approved with compensating controls by the Security Officer and asset owner; it’s linked to the original finding and reviewed until resolved.

Q: Do scanners replace penetration testing?

No—automated scanning complements (but doesn’t replace) our third-party annual pentests of the web app and APIs. See Penetration testing for method and latest results.