Good things to ask a security vendor.

Both. Torva Edge checks what the internet can see: public addresses, websites and email records. Torva Core is a Windows agent you install on one computer inside the network; it scans the private ranges you approve, including devices on separate VLANs.

Yes. Edge and Core read the software version each network service reports, such as a web server, PHP, WordPress, SSH or a database, and match it against the NIST National Vulnerability Database. Flaws on CISA’s Known Exploited Vulnerabilities list are marked and put at the top. Linux distribution builds that patch without changing the version are marked “verify patch level”. Node.js doesn’t report its version, so Node.js apps are flagged for you to confirm they’re patched.

No. Torva alerts on vulnerabilities attackers are actually using (CISA’s Known Exploited Vulnerabilities list) and on critical flaws that can be exploited remotely without a login. Other published CVEs go on a collapsed watch list. Torva re-checks your stored software versions every time the threat data updates, so if a watch-list item starts being exploited, it verifies the affected devices and emails you the same day, without waiting for your next scan.

Findings are grouped by the change that fixes them. When you’ve checked something, such as remote desktop that already requires MFA, sign it off as Verified or Risk accepted with a reason and review date. It leaves the list until the review date passes or something about it changes, and the sign-off is recorded as evidence.

No, and it isn’t meant to. Those alerts come from software installed on each computer, like browsers, Office and PDF readers, which a network scan can’t see because it doesn’t listen on the network. Keep that software on automatic updates through Windows Update for Business, Intune or your patch tool. Torva covers the other half: services an attacker can reach over the network, which patch alerts don’t show.

No. A penetration test is a person actively trying to break in, usually once a year. Torva watches every day for the configuration mistakes attackers look for first, and keeps watch between deeper assessments.

Scans are paced and non-destructive. Torva identifies weaknesses without exploiting them, and scheduled scans run in your scan window, 10 PM to 4 AM by default.

A small agent on a machine you choose. It connects outbound to Torva, so no firewall ports are opened, and it scans the network ranges you approve. You can pause or remove it at any time.

You add a TXT record to the domain’s DNS at _torva.yourdomain.com with a token from your dashboard. Only someone who controls the domain’s DNS can do that, and until it’s done the domain can’t be scanned. How to verify your domain.

Edge scans come from 40.160.38.187. Use it so your firewall and monitoring tools recognize Torva instead of treating the scan as an attack, but don’t open ports for it. Changes are announced on the security page and by email first.

No tool can do that alone, because HIPAA also covers policies, training and physical safeguards. Torva covers the technical side: it tests your systems, maps findings to the Security Rule and gives you dated evidence for your risk analysis.

Every plan starts with 14 days free. Add a card at checkout and you won't be charged until day 15. You'll get a reminder email a week before the trial ends, and you can cancel anytime from your account.

Yes. Cancel from your account and your plan stays active until the end of the billing month.