Vulnerability Management

Allow for suppression for vulnerabilities for user/group on M365. For instance, it is not feasible to enable MFA for directory sync accounts. But I would not want the MFA remediation to be completely suppressed if other accounts that should have MFA, need to have this remediated.

The ability to suppress vulnerabilities is great but it would be great to see this same feature in the Compliance Standards Tab. There are many Internal Checks within the standards that will not meet compliance or will have a modified value. I wish there to be a section in ConnectSecure where we could document these exceptions and track them while we are working on Annual Assessments

Currently a scan job (local probes and external scanner) can be hung up and fail for literal months, and there's no automated action or alerting. You're forced to manually dig through job logs in multiple places to manually validate scanning consistency.

I maintain a single global application baseline policy that detects 200+ RMM tools. Some customers are explicitly approved to use specific tools (e.g., Alpha‑Company is approved for Zoho Assist). Today, there is no way to exclude a single application for a specific customer while keeping the rest of the baseline intact. Current behavior: * Tags apply at the policy level, not per application * Excluding Zoho Assist via a tag suppresses alerts for all tools in the policy * The only workaround is splitting the baseline into individual policies, which creates unnecessary policy sprawl Requested capability: * Allow per‑customer / per‑application exclusions within a consolidated policy, so approved tools can be exempted without breaking apart the entire baseline. * This would significantly reduce policy overhead while preserving strong baseline detection.

Can we please add the ability to view Suppression Notes for suppression approval request. As the approver of the suppression "Justified for business reasons", "Compensating control in place" is not enough information to approve or deny a request. I need to know why it is "Justified for business reasons" or what "Compensating control in place" The same reasoning can be applied to "False Positive" and "Other"

Would be really nice if the status portal, https://status.myconnectsecure.com/ , includes what services are impacted that the end user would see by the outage or partial outage. This would reduce the liklihood of unneeded tickets from being created. With a note that says "Partial Outage" to API Health, there's no indication as to how that impacts end users and what they expect because of the outage.

With Essential 8 there is a need to monitor for Online-Services which in scope would be SAAS Applications used in an environment, would love to see a feature where detecting potentially accessed SAAS apps via some form of network monitoring can occur or manually adding SAAS apps to a company to monitor health status, for example: End of life or End of Support status Health example Online/Offline/Unhealthy Compliance checks (does the platform have any trust center that details if they are SOC/ISO27001 compliant for example and still are compliant?) Monitor vendor risk for example known compromise where potentially the company may need to be aware of data leakage or password leakage risks. Service example like: M365, Google & Amazon Varonis Employment Hero & Job Adder Cloudflare Verisign Bluebeam LastPass Keeper Xero

Instead of having to create the same exclusions at each client, add the ability to create a global exclusion list.

Would like to have the ability to perform a suppression on external scan data for insecure ports identified and mitigating controls or accept risk is in place. Key example is VPN port 4433 is open and by default is insecure. However, the requirement of user credentials, MFA, specified internal group membership, and other measures are in place to help mitigate the business accepted risk. Without suppression, the asset will negatively impact risk score for those items with compensating controls.

Requesting domain expiration be added as part of domain scanning for either external asset scanning or attack surface mapper scanning. The expiration date of a domain is publicly available for most domains. As an MSP, it would be extremely beneficial for us and our clients if domain scanning included the expiration date of our clients' domains, so that we can alert our clients when their domain is nearing expiration. If added, it would be best for this to be included as an event set so we can setup alerting for a client's domain nearing expiration.