¶ Vulnerability Compliance Automation
¶ What you'll be able to do
After reading this guide you will understand how VeriPath Dental keeps an automated, auditable record of the platform's security posture. You will learn how to open the Vulnerability Compliance page, read the latest Lynis hardening and dependency (pip-audit) scan results, review the scan history, and trigger an on-demand scan when you need a fresh check — for example before a DSPT return or after a platform update.
Who does this? Practice managers, dental admins and admins (roles
DENTAL_PRACTICE_MANAGER,DENTAL_ADMINandADMIN). The Vulnerabilities link appears in the top navigation for these roles only.
¶ How the scans work
The page shows results from automated scans that run in the background — there is nothing to set up:
- Daily Lynis scan — checks the hardening of the platform (system configuration, permissions, services). It produces a Hardening Index (0–100) and a list of warnings and suggestions.
- Weekly dependency audit (pip-audit) — checks the Python packages the platform runs on against published vulnerability databases. It produces a list of vulnerable packages with their advisory IDs.
- On-demand scan — you can trigger an extra scan from the page at any time (limited to 3 per hour and 10 per day per user).
Every scan is recorded in the compliance audit ledger, so the results are available as evidence for the DSPT return.
¶ Step 1: Open the Vulnerability Compliance page
- Log in to VeriPath Dental.
- In the top navigation, open the Financial group and click Vulnerabilities.
The page opens showing the Latest Scan card at the top and the recent Scan History below.
¶ Step 2: Read the Latest Scan card
| Field | What it shows |
|---|---|
| Started / Completed | When the scan ran |
| Hardening Index | The Lynis score out of 100 — the higher, the more hardened. Shows — for dependency audits, which don't produce a hardening score |
| Status | Requires attention (red) when the scan found high or critical findings; No critical / high findings (green) otherwise |
¶ Step 3: Read the scan summary
The summary section changes depending on the type of the latest scan:
- After a daily Lynis scan you see the Lynis Hardening Summary, with the number of warnings and suggestions recorded.
- After a weekly dependency audit you see Dependency Vulnerabilities (pip-audit): the total number of known vulnerabilities, and a table listing each affected package, its installed version, and the vulnerability count with the advisory IDs:
¶ Step 4: Review findings by severity
For Lynis scans, Findings by Severity shows one badge per severity level that has findings — Critical, High, Medium, Low, Warning, Suggestion — with the count for each.
¶ Step 5: Review the scan history
Scan History lists the 15 most recent scans:
| Column | What it shows |
|---|---|
| Started | When the scan ran |
| Status | Badge: PENDING, RUNNING, COMPLETED or FAILED |
| Type | Scheduled (automatic) or On-demand |
| Hardening | The Lynis hardening index (— for dependency audits) |
| Vulnerabilities | Attention (amber) when the scan found high or critical findings; the vulnerability count (red) for dependency audits; — otherwise |
¶ Step 6: Run an on-demand scan
- On the Vulnerability Compliance page, click Run On-Demand Scan.
- The app starts a new scan and returns you to the page with a confirmation message.
- When the scan finishes it appears as the latest scan with the type On-demand. Scans run in the background and usually complete within a minute.
If you have used your allowance, the app shows Scan limit reached with the time to wait — the limits are 3 scans per hour and 10 per day.
¶ Useful tips
- No action needed — the scans run automatically on schedule and the results stay in the audit ledger.
- Use Run On-Demand Scan before a DSPT return or after a platform update for a fresh picture.
- Requires attention means high or critical findings were recorded — the ledger keeps the detail for your compliance review.
- The page is read-only apart from the scan trigger — it can't change system settings, only start a check.
- Before the first scan has completed, the page shows a note that no vulnerability scans have run yet.