SECURITY ATLAS / EVALUATION BRIEF Cisco Vulnerability Management Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/cisco-vulnerability-management/ THE ATLAS TAKE Cisco Vulnerability Management, formerly Kenna, belongs in a migration plan rather than a new-product shortlist. Cisco states that new sales ended March 10, 2026, renewal and addition deadlines passed June 11, 2026, and eligible support ends June 30, 2028. Atlas analysis: existing users should prioritize export fidelity, ownership continuity, and replacement workflow validation. Historical risk scores and exceptions are operating records, not merely dashboard data. Move those records deliberately, preserve their context, and compare replacement results without assuming that two vendors calculate risk or identity the same way. SCOPE This is not a current purchase path. End of sale is 10 March 2026 and last support is 30 June 2028. Remaining work is inventory, export, and successor design on the remaining support term, not new licenses. WORTH A LOOK WHEN Existing customers documenting the inherited program and preparing a replacement before their contractual support ends. THINK TWICE WHEN The organization is selecting a new long-term vulnerability platform or assuming legacy support implies continued product expansion. IMPLEMENTATION 1. Freeze the dependency inventory List connectors, saved views, reports, API consumers, ownership fields, and retention requirements. 2. Rehearse a complete export Include active and inactive assets, open and closed vulnerabilities, fixes, and custom fields needed by the program. 3. Parallel the replacement Reconcile representative cohorts and reporting before disabling legacy integrations or access. OPERATING REALITY Migration requires coordination across scanner owners, reporting consumers, ticket integrations, and audit stakeholders. Atlas analysis: export both unresolved work and the context behind accepted risks. A replacement that imports vulnerabilities but loses ownership, exceptions, or historical meanings can leave the program operationally weaker after cutover. COMMERCIAL CONSIDERATIONS Treat this as a transition budget: verify existing support entitlement and fund replacement overlap, extraction, and workflow reconstruction. - Remaining contracted support term - Replacement overlap and migration assistance - Historical-data retention and integration rebuilding EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Reconcile an export Acceptance evidence: Compare source and destination counts for a defined cohort, including custom ownership and exception fields. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Validate risk meaning Acceptance evidence: Explain how a legacy risk meter maps to replacement priorities without equating numeric scores. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Rehearse cutover Acceptance evidence: Show current scan ingestion, owner routing, archived evidence access, and a documented rollback decision. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Which asset identifiers, open findings, exceptions, and service-level rules actually export in a reusable form? - What remaining support term applies to this instance, and who owns the successor decision? - Which scanner integrations and threat-feed assumptions would have to be rebuilt elsewhere? EVIDENCE GAPS - No customer-specific support contract or export was inspected. - Replacement data-model compatibility and preservation of historical reports require a migration rehearsal. SOURCES Cisco amended end-of-life notice (Lifecycle) https://www.cisco.com/c/en/us/products/collateral/security/vulnerability-management/vm-vi-appsec-eol.html Exporting Cisco Vulnerability Management data (Documentation) https://help.kennasecurity.com/hc/en-us/articles/212752466-Exporting-data-from-Cisco-Vulnerability-Management API key generation and permissions (Documentation) https://help.kennasecurity.com/hc/en-us/articles/360029111331-API-Key-Generation-and-Permissions Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.