Scan output in. A POA&M that remembers, out.
Feed it your scanner exports. It produces a plan of action that carries its own history — what opened, what closed, what has been sitting past its remediation window since March — instead of being rebuilt by hand every cycle.
A spreadsheet has no memory.
Every cycle someone exports four thousand rows and starts reconciling by hand. Which of these did we have last month? Which closed? Which milestone dates quietly passed? Was that one a false positive, and where did we write down why?
The reconciliation gets done badly or not at all. The POA&M churns, findings lose their history, and the assessor stops trusting the document. The work is not hard — it is just tedious enough that nobody does it consistently.
Auto-POA&M treats a finding as something with a life, not a row. The same vulnerability on the same host next month is the same item with more history. That one property is what makes an aging report, an overdue count, and a burn-down trend possible.
What it does.
Four steps. You review the one that needs judgement.
1 · Ingest
Nessus, Tenable, Qualys, AWS Inspector, Defender for Cloud and Wazuh — plus last cycle's POA&M. Nothing is installed and nothing touches your network.
2 · Reconcile
Findings matched against the previous POA&M by asset and finding identity, across sources that each name the same machine differently. New, carried over and closed separated out. Aging measured from first discovery.
3 · Map and draft
Controls resolved from the CCI list and benchmark references rather than guessed. Remediation language drafted where needed. Anything uncertain is flagged, not filled in quietly.
4 · Review and export
You work the flagged queue, which is short. Then export — Excel, eMASS-ready, or OSCAL — all off the same data, so they cannot disagree with each other.
The three things nothing else does.
It remembers
Scanner dashboards are point-in-time. They can tell you how bad today is; they cannot tell you whether the programme is working. Net change cycle over cycle is the number an assessor reads first and almost nobody produces it.
It reconciles across tools
Inspector keys on instance ID, Defender on resource ID, Wazuh on agent ID, Nessus on IP. Same machine, four identities. Merging them needs asset identity resolution with confidence scoring — the genuinely hard part, and the reason a naive diff reports thousands of fixes that never happened.
It holds nothing
Runs as a container in your environment. Nothing persists after your output is generated. Your POA&M file is the state — you hold the history, I do not. No database of your findings exists on my side to breach, subpoena or hold hostage.
Whatever you have to produce.
Same engine. The obligation decides the output, not the other way round.
RMF & eMASS
STIG findings carry CCIs, and CCIs map to 800-53, so the control column populates itself. Remediation windows track the 30, 90 and 180 day clocks, and the overdue count sits where your AO looks first. If you run eMASS this feeds it rather than replacing it.
CMMC & 800-171
Third-party assessment is deferred; the requirements are not. Your SPRS score is a representation you made, and closeout is tied to contract eligibility. A POA&M with real dates is how you prove the score was true.
ISO 27001 & SOC 2
Annex A 8.8 wants technical vulnerabilities managed; SOC 2 wants them remediated on a defined schedule. Both auditors ask the same thing: show me a finding, when you found it, and that it closed. A screenshot of a dashboard proves none of that.
How to get it today.
The tool is not finished. The work it does is available now.
Hire me to run it
Fixed fee · scoped per environment
I clean up your scan pipeline so the findings are defensible, set severity-to-deadline policy against your framework, reconcile what you already have, and hand you a POA&M that tracks to verified closure — plus the process to keep it running after I leave.
Auto-POA&M is how I deliver that in weeks instead of months. You buy the outcome; the software is my tooling, not your purchase.
Talk about an engagementLicence it yourself
Per system, flat — never per asset
A hospital with four thousand endpoints and one boundary should not pay more than a startup with forty. Asset-count pricing is why people resent their scanner vendor and I am not repeating it.
It is not ready and I am not going to pretend otherwise. Join the list and you will hear when it is, with a straight note on what it does and does not do.
Want it first?
An email, and I send access when it opens plus a short note on what it actually does. No newsletter, no drip sequence.
See how I work, free.
All three run entirely in your browser. No upload, no account, no email.
Rev 4 → Rev 5 CCI carry-forward
The eMASS Rev 5 migration left controls sitting at Non-Compliant because their individual CCIs came across unassessed. Load your Rev 4 and Rev 5 exports and this matches them on CCI — stable across revisions — so assessment results you already have carry forward. You get an auditable file with one row per CCI and an import-ready file that is your original workbook with only the four assessment columns rewritten.
Scan triage & POA&M aging
Drop in a CSV from any of six scanners. Get your remediation clock, real overdue counts, how many rows are actually the same finding, and your highest-leverage fixes. Add a second export and you get net change — the number nobody produces by hand.
Endpoint audit rollup
You asked fifteen people to run an audit script and got fifteen JSON files back. Drop the whole set in and get one compliance matrix, an exceptions list naming every machine and what failed on it, and a CSV your auditor will accept. The policy thresholds are yours to set.
OSCAL POA&M validator
Check a plan of action against the model structure and the FedRAMP conventions people most often miss. Tells you what fails and why, in plain language.
The free tools are a thin slice of the same engine. What they cannot do is remember between visits or reconcile across scanners — which is most of what you are actually buying.
Also being built.
Same rule as everything else here — it shows up when it works.
Coverage gap analysis
Your NAC, scanner, directory and endpoint console each know about a different set of machines, and none knows what the others are missing. Point this at their exports and it tells you which subnets have no agent, which assets appear in one system and nowhere else, and where your inventory is lying to you.
Remediation output
Terraform, Bicep, Ansible and PowerShell snippets attached to the findings they close, and alerting when something on your POA&M starts being actively exploited. The point is to shorten the gap between knowing and fixing.
Running scans and dreading the paperwork?
Tell me what you scan with and what you have to produce. I'll tell you straight whether this helps.