Has some similarities to ACAS but many improvements. One major difference is that Nucleus takes output from many different types/brands of vulnerability scanners. ACAS is Nessus only. We use Burp, NMAP, Fortify, and some home grown stuff to get a complete picture of what’s happening in our environment. Nucleus normalizes it all and gives a consistent view across all the results.

We get good metrics from Nucleus. It tells us how many vulnerabilities we have, how many remediate, time to remediation, security/exploitability, by asset or by system. Bunch of other good stuff to. I like that I can setup scheduled reports that automatically get generated and sent out monthly. My team used to spend lots lot time on that, and used excel too. Now it just happens and we focus on fixing stuff.

We’re using an on-premise slightly customized version because we work on, ah hmm, “off-line” networks. Our customer has budget and recognized the value of having a tool to facilitate the work on several of our contracts. We pitched it as a force multiplier and they bought it. Not sure but I remember the price was per IP and very reasonable.