If you're a KPA Privacy client, Cyrisma is the vulnerability management platform that comes with your program. This November, Cyrisma added three capabilities with one thing in common: they make it easier to show your work, not just do it.
That matters more than it sounds. The FTC Safeguards Rule asks dealers to run vulnerability assessments at least every six months, and sooner or later somebody (an auditor, a cyber insurer, your own dealer principal) asks how you know a problem was fixed. A finding that quietly drops off the next report isn't proof. A record of what changed, on which machine, and when, is.
Here's what's new.
New: Patch and Remediation History With Before-and-After Versions
New: Patch and Remediation History now shows what was changed in each fix, plus the software version before and after it.
-
What it is: A before-and-after record for every remediated vulnerability: the change made, the previous software version, and the updated one.
-
Why it's important: A finding that disappears from a report isn't evidence. A version-to-version record is, and it's what auditors and cyber insurers ask to see.
-
Regulation: FTC Safeguards Rule, 16 CFR 314.4(c)(7), which requires change management procedures, and 314.4(d)(1), which requires you to regularly test or monitor that your safeguards work.
-
Use case:
-
A scan flags an outdated browser on the F&I office PC that opens credit applications all day.
-
Your IT provider updates it, and the history logs the change with the old and new versions.
-
At your next Safeguards review, you hand over that record instead of saying "we patched it."
New: Compliance Scanning Across 30+ Frameworks
New: Compliance Scanning checks your endpoints against more than 30 compliance frameworks.
-
What it is: A scan of how each PC and laptop is configured, measured against 30+ frameworks, with results tracked over time so you can see your posture change.
-
Why it's important: Vulnerability scans find missing patches. Compliance scans find risky settings that no patch fixes, and the history shows whether you're improving between six-month reviews.
-
Regulation: FTC Safeguards Rule, 16 CFR 314.4(d)(2), which requires continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months, and 314.4(c)(1), which requires access controls.
-
Use case:
-
You run a compliance scan across every endpoint in the store.
-
It finds the service drive laptop never locks when left unattended, and two parts counter PCs share an outdated setting.
-
Your IT provider fixes both, and the next scan shows the gaps closed.
To set up your first compliance scan, watch Cyrisma's how-to video.
New: Deeper Vulnerability Evidence That Finds the Root Cause
New: The vulnerability evidence view now traces each finding back to where it actually comes from.
-
What it is: A deeper look at every finding: embedded vulnerabilities shared across multiple applications, whether the software was user-installed or system-installed, and the underlying dependency causing it.
-
Why it's important: You fix the root cause once instead of chasing the same finding across several programs. That means fewer tickets and less guesswork for your IT provider.
-
Regulation: FTC Safeguards Rule, 16 CFR 314.4(c)(2), which requires you to identify and manage the data, devices and systems your business runs on.
-
Use case:
-
The same vulnerability shows up in four different programs on the sales floor PCs.
-
The evidence view shows they all bundle one outdated component, and one program was user-installed.
-
Your IT provider updates that component and removes the program nobody needs, clearing all four findings.
See the new evidence view in action in Cyrisma's showcase video.
Available Now for KPA Privacy Clients
All three updates are live now in the Cyrisma platform that comes with KPA Privacy. You're already scanning and fixing. Now you can prove every fix, catch the risky settings patches miss, and go straight to the root cause.
That's a stronger answer for your auditor, your insurer, and the customer who trusted your finance desk with their Social Security number.
Questions? Connect with your KPA Rep.
.png)