Install once, scan approved ranges
Download your site-bound TorvaCore-Install.bat from Core sites. Approve administrator access, confirm the detected local range and add any routed VLAN ranges you are authorized to scan. The agent runs as the Torva Core Windows service, starts with Windows before anyone signs in, and provides local browser controls and a tray shortcut.
Device coverage across company sites
Internal network scanning is part of Torva Complete: $75/month including 60 devices, $1.25 per additional device, with base and device charges capped at $375/month (300+ devices included). Additional domains are $5/month each. Devices are shared across all your company sites, with no separate site surcharge. Discovery shows additional devices without assessing them or charging automatically.
Scheduled scans start inside your scan window (10 PM to 4 AM by default) and pace their connections gently, so monitoring tools and fragile devices aren’t flooded. A device counts as responding when it answers ping or has an open port. Addresses that haven’t responded for 30 days are skipped, and you can clean them out of your device record from the site page.
Find outdated software with known vulnerabilities
Core reads the version each service reports (SSH, web servers, databases and more) and matches it against the NIST National Vulnerability Database and CISA’s Known Exploited Vulnerabilities catalog. Each finding names the CVEs, most severe first, flags any that are actively exploited and gives the version that fixes them. Linux distributions such as Ubuntu, Debian and Red Hat often patch without changing the version number, so those builds are marked “verify patch level” instead of a confirmed critical. Ranges you mark as sensitive or connectivity-only are never version-read.
Exact Windows versions, without logging in
Core identifies each Windows machine’s version (Windows 11, Windows 10, Windows Server 2022, 2019, 2012 R2 and older) from the reply Windows gives when a connection starts. It never sends a password or completes a sign-in. Machines on a version Microsoft no longer supports, such as Windows 10 since October 2025, become a high-priority “Retire or upgrade (past end of support)” issue, with the device names you need to find them.
Safe for sensitive equipment
Imaging consoles, lab analyzers and patient monitors can misbehave when contacted unexpectedly. Tell Torva where they are and choose a light check (Torva only confirms the device is present) or no contact at all. When a scan sees signs of sensitive equipment you haven’t listed, such as a medical vendor’s name, imaging or HL7 services, or an embedded operating system, Torva applies lighter checks on subsequent scans until you review it. Initial detection still requires network probes.
A grade that reflects your weakest devices
Each responding device gets a letter from its worst open issue (critical F, high D, medium C, low B, otherwise A), and the site’s score is their average. An open critical issue caps the grade at B, and an actively exploited one caps it at C, so a single serious problem can’t hide behind hundreds of healthy PCs. Issues you sign off as verified or as an accepted risk stop counting, and come back automatically at their review date.
Alerts if scanning stops
If the scanning computer stops checking in for 24 hours (it was turned off, replaced, or Windows updates stopped the service), you get an email and a phone notification, and the dashboard says so. You get one more email when it’s back.
From finding to fixed
Every issue on the dashboard opens with why it matters, numbered fix steps and the affected devices, one line each with their ports. Mark it in progress so leadership can see it’s being handled, or send it to your IT provider by email with everything they need; replies come to you. For common Windows fixes (Remote Desktop without NLA, old TLS on Windows servers, FTP or Telnet services, IIS security headers) you can download a ready-to-run PowerShell fix script with the affected devices filled in: it previews first, keeps a backup, can undo, and never includes sensitive equipment. After the fix, scan again to confirm, or sign it off with a reason and a review date.
HIPAA context for what Core finds
Turn on HIPAA Security Rule reporting and every internal finding shows the safeguard it relates to, with the citation: outdated or end-of-support software under vulnerability and patch management (45 CFR 164.308(a)(1)(ii)(A) and (B)), old encryption protocols and expired certificates under transmission security (164.312(e)(1)), and remote access without strong authentication under access controls (164.312(a)(1) and (d)). These are related requirements, not findings of a violation, and they’re worded so your compliance lead can use them.
Core also gives your HIPAA risk analysis what it needs most: an up-to-date inventory of the devices on your network, by Windows version and device type, including the sensitive equipment you mark. With Torva Complete, those devices and findings flow straight into the compliance workspace as assets and suggested risks. NIST CSF 2.0 and the FTC Safeguards Rule are available too. How Torva supports HIPAA
What Core doesn’t do
Core never logs in to your devices. It doesn’t inventory installed patches or Windows updates, and it isn’t a replacement for patch management or an authenticated vulnerability scanner. It finds what is visible on the network: exposed services, weak encryption, outdated software versions and risky configurations. Software that only runs on a computer, such as browsers, Office and PDF readers, doesn’t listen on the network, so it won’t appear here; keep it on automatic updates through your patch tool.
Understand the findings
Review common TCP service exposure, outdated software, selected web settings, certificates, TLS protocol observations and RDP negotiation checks. Reports count issue types once, show how many devices each affects, and sort every scored device by its worst finding so the numbers add up. When something changes, the alert email lists what changed and the report opens with the same list. No-response addresses remain unassessed.
Alerts when a flaw becomes real
Published vulnerabilities that nobody is exploiting go on a collapsed watch list, not your to-do list. Torva keeps the software versions each scan found and re-checks them whenever the threat data updates. If one starts being used in attacks, the agent re-scans just those devices within minutes and you get one email: still present, or already fixed.
A to-do list, not an alert queue
Everything Core reports is reachable across your network. Actively exploited software goes to the top, and findings are grouped by the change that fixes them. When you’ve checked an item, such as a legacy device on an isolated network or remote desktop that already requires Network Level Authentication, sign it off as Verified or Risk accepted with a reason and a review date. It leaves the to-do list and the top of the PDF, and comes back if a new device shows the same problem, the severity rises, the software version changes or the review date passes. Each sign-off records who approved it and when.
Change ranges from the dashboard or the scanning computer
Edit network ranges and exclusions on the site page; the change takes effect after the account owner confirms it from an email, and the scanning computer picks it up at its next check-in. Administrators on the scanning computer can change ranges there directly (the owner is notified) or lock ranges to that computer.
Outbound connection and automatic updates
The agent contacts your dashboard over HTTPS; no inbound firewall rule is required. Local controls bind to the loopback interface. The agent checks hourly for signed updates while idle. Windows stops the service, applies the update and starts it again, and the previous version is restored automatically if the update fails to start. The bundled runtime is updated through installer releases.
Windows x64 and administrator access are required. This release is not yet publisher-signed, so Windows or company policy may require administrator review. Read setup instructions.
Keep configuration and reporting together
Use Setup for ranges and scan settings, and Reports & Scans for reports and manual scans. Your security dashboard brings the latest Edge and Core findings together, with links to separate detailed reports. Complete adds combined Executive summarying.
For a repeatable routine, see the weekly security review and how updates and hardware changes can shift security settings.