Hinoki — continuous vulnerability scanning and patching

synology-nas-01

api-gw-01

db-primary

cms-prod-02

auth-svc

redis-03

ml-worker-09

staging-wp

queue-broker

cdn-edge-us

k8s-ingress

monitoring

payroll-db

vault-01

ci-runner-03

logs-agg

dns-int

smtp-relay

s3-proxy

ldap-02

kafka-01

etcd-node-2

consul-01

haproxy-ext

nfs-share

grafana-01

jenkins-m

registry

bastion

vpn-gw

splunk-idx

elastic-01

postgres-ro

memcache-05

worker-18

2,847 agents monitoring your infrastructure

HHinoki Agent· synology-nas-01

Monitoring

Hinoki14:32

Scan

52 sources checked

Detect

CVE-2026-27143 · Critical

Assess

DSM 7.2.1 — affected

Exploit

RCE confirmed

Resolve

Patch → @jlee

Exploitability analysis

Affected versionversion present

ExploitableHinoki validated

From the networkremote scan

Not analyzed

On the hostvia Hinoki agent

Not analyzed

!Exploitable on the hostLive 1h after disclosure

How it works

Confirmed affected DSM version

Server process and library present

Network listener exposed

RCE achievable — unauthenticated

Remediation

↑

Update DSM 7.2.1 → 7.2.2Patch generated for CVE-2026-27143

⟶

Deployed to synology-nas-01Maintenance window · 02:00 UTC

✓

Verification scan passedRe-ran exploit — no longer vulnerable

●

Ticket VULN-847 closedOwner @jlee · Resolved in 47 min

synology-nas-01 · DSM 7.2.1 · 10.0.1.400:00

have context

have an owner

have time

Fixed

findings

Generating findings was never the hard part.

Every tool can generate more findings.

The real problem is the funnel: too many issues, too little context, too many teams to chase, and too few fixes landed in time.

As AI compresses the window from disclosure to exploitation, defense needs more than another scanner.

Solutions

Action on your exposures, in minutes not days

Finally, a solution designed around surfacing risks that truly warrant your attention.

Built for mature security leadership

Prove risk reduction effortlessly

Turn scanning, ownership, remediation, and retesting into one story: what risk moved, which teams drove it, and where progress is stuck.

01/04 // signal

Show what changed. Not just what closed.

Translate fixes into business impact: less blast radius, fewer public paths to crown-jewel systems, and more high-risk exposures closed with confidence.

02/04 // ownership

Three teams moved fast. Two are holding the program back.

See patching momentum, SLA adherence, and unresolved exposure by business unit, region, reporting chain, or custom grouping.

03/04 // decisions

Know what fixed it. And what still needs a decision.

Separate validated fixes from scheduled patch waves, pending maintenance windows, vendor blockers, and approved exceptions, so leaders know what is genuinely solved and what is simply waiting.

04/04 // board ready

Walk into the board meeting with one answer.

One executive view that proves the program is working: risk down, teams improving, blocked items explicit, and no argument over what the numbers mean.

HSignal

30d90dYTD

Open Findings

142↓ 14%

Mean Time to Remediate

8d↓ 4d

Coverage

94%↑ 6%

Risk trend — 90 days

Critical

3↓ 3

High

18↓ 12

Medium

67+ 2

Low

54↓ 8

HOwnership

By Business Unit

Program SLA

82%

Teams On Track

3 / 6

At Risk

TeamOpenSLAResolved (90d)

Platform Eng896%

Cloud Infra1291%

Data Services1488%

Payments2372%

Mobile Apps3164%

Legacy Systems5441%

HDecisions

28 pending

Resolved 52Scheduled 12Waiting 8Blocked 5Excepted 3

critCVE-2025-31337 — libcurl heap overflowPlatform Eng4d openVendor fix pendingTrack

critCVE-2025-29114 — OpenSSL cert validation bypassCloud Infra2d openPatch reviewApprove

highCVE-2025-28890 — Node.js prototype pollutionPayments11d openMaint. windowExpedite

highCVE-2025-27003 — PostgreSQL privilege escalationData Services6d openImpact reviewApprove

medCVE-2025-26551 — nginx request smugglingPlatform Eng18d openScheduled Q4Accept risk

highCVE-2025-25701 — Kubernetes RBAC bypassCloud Infra3d openDep. conflictEscalate

HHinokiQuarterly Security Posture Report

Q3 2025 · Jul–SepConfidential

Executive Summary

Risk Score

↓ 18 vs Q2

Open Critical

↓ from 6

Resolved

127

↑ 41% vs Q2

SLA Compliance

82%

↑ from 71%

Risk trend — 12 months

Key Decisions & Actions

libcurl heap overflow patched across all prod hosts within 48hClosed

Legacy payment gateway — vendor fix ETA Nov 15; risk accepted with compensating controlsOpen

3 exceptions approved for end-of-life middleware; decommission scheduled Q1Deferred

Overall Security PostureImproving ↑

Hinoki does continuous vulnerability scanning and patching in one modern, unified platform.