The Atlas take.
Cisco Vulnerability Management, formerly Kenna, belongs in a migration plan rather than a new-product shortlist. Cisco states that new sales ended March 10, 2026, renewal and addition deadlines passed June 11, 2026, and eligible support ends June 30, 2028. Atlas analysis: existing users should prioritize export fidelity, ownership continuity, and replacement workflow validation. Historical risk scores and exceptions are operating records, not merely dashboard data. Move those records deliberately, preserve their context, and compare replacement results without assuming that two vendors calculate risk or identity the same way.
02 / DEFINE THE BOUNDARY
What you are actually evaluating.
This is not a current purchase path. End of sale is 10 March 2026 and last support is 30 June 2028. Remaining work is inventory, export, and successor design on the remaining support term, not new licenses.
Names you may encounter Kenna.VM · Kenna. Historical names do not establish current feature equivalence.
03 / THE CONTROL PATH
Where it sits. How it works.
Atlas migration interpretation: preserve source relationships and existing program records, map them to a replacement, then retire integrations under change control.
- 01
Legacy program records
Assets, findings, fixes, groups, and accepted-risk decisions need an inventory.
- 02
Controlled export
UI and asynchronous API exports offer different formats and operational limits.
- 03
Replacement validation
Reconcile records, rebuild routing, and confirm current scans before cutover.
04 / WHAT EARNS ITS PLACE
Strengths, with the evidence attached.
Atlas analysis of documented capabilities; availability and behavior depend on the edition and environment.
Export mechanisms are documented
The help center explains UI exports and asynchronous API export requests, including selectable models and fields.
API roles support controlled extraction
API permissions follow user roles, allowing an export plan with constrained access where appropriate.
Inspect the documented capability notes
- Risk-based ingest of findings from existing scanners rather than replacing those scanners.
- Threat-feed context applied to ingested vulnerabilities.
- Service-level tracking by risk for owner follow-up while the product remains supported.
05 / KNOW THE COMPROMISES
The tradeoffs to take seriously.
Architectural implications and procurement questions from Atlas; these are not independently measured product failures.
The lifecycle has fixed deadlines
Cisco lists end-of-sale, renewal, and last-support milestones; eligibility still follows the customer contract.
06 / FROM PURCHASE TO PRACTICE
Make it work in your environment.
A proposed implementation sequence. Confirm supported versions, permissions, and rollback with the current documentation.
- 01
Freeze the dependency inventory
List connectors, saved views, reports, API consumers, ownership fields, and retention requirements.
- 02
Rehearse a complete export
Include active and inactive assets, open and closed vulnerabilities, fixes, and custom fields needed by the program.
- 03
Parallel the replacement
Reconcile representative cohorts and reporting before disabling legacy integrations or access.
07 / THE OPERATING COMMITMENT
The bill is only part of the cost.
Commercial shape
Treat this as a transition budget: verify existing support entitlement and fund replacement overlap, extraction, and workflow reconstruction.
- Remaining contracted support term
- Replacement overlap and migration assistance
- Historical-data retention and integration rebuilding
08 / COMPARE THE JOB
Put these beside it.
Alternatives worth examining for the same problem. Check each offering’s scope before treating it as a substitute.
Brinqa Platform
Compare for a replacement risk-aggregation and remediation layer over existing scanners, with explicit data-model migration.
TenableTenable One
Compare when replacing aggregation together with a wider native vulnerability and exposure platform.
09 / MAKE THE DECISION OBSERVABLE
Earn confidence through a real evaluation.
Suggested by Atlas. Agree acceptance criteria, use synthetic fixtures in an authorized environment, and capture both useful work and failed controls.
- TEST 01
Reconcile an export
Acceptance evidence: Compare source and destination counts for a defined cohort, including custom ownership and exception fields.
- TEST 02
Validate risk meaning
Acceptance evidence: Explain how a legacy risk meter maps to replacement priorities without equating numeric scores.
- TEST 03
Rehearse cutover
Acceptance evidence: Show current scan ingestion, owner routing, archived evidence access, and a documented rollback decision.
START WITH ONE EXERCISE
On a licensed Cisco Vulnerability Management instance you still operate, export asset identifiers, findings, exception records, and risk-based service-level configuration into durable storage you control. Do not purchase new licenses.
Evidence to look for: A reviewer can rebuild asset identifiers, open findings, and documented exceptions from the export without the console, and can state the remaining support term and that no vendor-named replacement appears in the bulletin.
Questions to bring to the vendor
- Which asset identifiers, open findings, exceptions, and service-level rules actually export in a reusable form?
- What remaining support term applies to this instance, and who owns the successor decision?
- Which scanner integrations and threat-feed assumptions would have to be rebuilt elsewhere?
10 / SHOW THE WORK
Evidence, and what is still unknown.
What this research cannot establish
- No customer-specific support contract or export was inspected.
- Replacement data-model compatibility and preservation of historical reports require a migration rehearsal.
Dossier research reviewed October 18, 2026. Earlier profile references are retained for traceability; products and commercial terms change.
- Cisco Vulnerability Management end-of-life bulletin ↗Earlier profile reference
- Cisco amended end-of-life notice ↗Lifecycle
- Exporting Cisco Vulnerability Management data ↗Documentation
- API key generation and permissions ↗Documentation
KEEP BUILDING YOUR JUDGMENT