Proof of fix: show clients what you fixed since the last scan

Every month you patch, rescan and send the client a report. And every month the report shows a long list of what is still wrong, while the work your team did is invisible.

Proof of fix changes that. Varaxon Scan Hub reports now open with a Since the last scan section that names what your team fixed.

Key takeaways

• Each report compares this scan with the previous scan of the same systems from the same scanner.
• It lists every issue that was fixed, came back or is new, with the systems it changed on, most urgent first.
• If the rescan did not log in, issues are marked not rechecked, never fixed.
• It is in the client's PDF and on the report page in the app, at no extra cost.

What the client sees

At the top of the section are five numbers: fixed, new, reopened, still open and not rechecked. Still-open issues are also split by priority band.

Below that are the lists:

• Fixed since the last scan. Each issue by name, with its priority band, a KEV tag if it is on the CISA Known Exploited Vulnerabilities list, and the systems it was fixed on.
• Back since the last scan. Issues that were fixed before and have returned.
• New since the last scan. Issues this scan found for the first time.

So instead of "we did some patching", the client reads "Zerologon fixed on dc01, OpenSSH fixed on three servers". That is the conversation you want to have at renewal.

The numbers come straight from comparing the two scans. AI does not write or guess them.

When it won't mark something fixed

A wrong "fixed" is worse than no proof at all, so Scan Hub is careful:

• The rescan didn't log in. If last month's scan logged in to a system and this month's didn't, issues that need a login to see were not looked for. They show as not rechecked and stay open until a logged-in scan checks again.
• A different scanner. Scanners name and check issues differently, so a Nessus scan is never compared with a Qualys scan. The comparison starts with the next scan from the same scanner.
• The scanner isn't named. An export that doesn't say which scanner made it is not compared, and nothing is marked fixed.
• A system is missing. If a system from last time isn't in this scan, its issues are not counted as fixed or still open. Some sources, such as Defender pulls and some CSV exports, list only systems that still have findings, so the report says so.

In the app (not in the client's PDF), you also get a note when every issue on a system vanished at once. That is usually good news, but it is also what a scan that never reached the system looks like.

How to use it each month

1. Scan the client with the same scanner and settings as last month. Use a logged-in (credentialed) scan if you can.
2. Upload the export, or let the Defender or ConnectSecure connection build the report.
3. Send the PDF. The fixed list is your proof of work. The new and reopened lists are next month's plan.

Proof of fix works with Nessus, Qualys, Rapid7, Greenbone/OpenVAS, Nuclei, Microsoft Defender and the other scanners Scan Hub reads. Your first three reports are free, with no card needed. Try Scan Hub or see sample reports.

Scan Hub is listed on Microsoft Marketplace and the ConnectWise® Marketplace, and it can push fixes into ConnectWise PSA as tickets.