Our mission
Security teams are not short on data. Every scanner they run produces more of it. What they lack is one surface where all of that output becomes a single finding with an owner, a deadline and a history. PMAP is built around that surface. We orchestrate the scanners, correlate their results into one deduplicated finding, and carry it through triage, SLA and remediation until it is verified closed.
PMAP exists because the reconciliation step kept costing real programs the time that should have gone to fixing things.
PMAP is owned and funded by Privia, a cybersecurity company whose teams have run enterprise vulnerability and security programs for years. That backing is not a logo on a slide. It means the product is shaped by people who still do the work, and it means a buyer can see who stands behind the platform, who pays for its roadmap, and who is accountable when something breaks.
We are open about that parentage because it is part of the due diligence any serious security team has a right to do. Knowing who owns a platform, who funds its roadmap and who answers when it fails is a fair question, and we would rather lead with the answer than make you go looking. The deeper origin story and the people behind the work live on the company page.
What guides us
These are not posters on a wall. They are the decisions we want a security team running PMAP to be able to make without asking for permission, because the platform already settled them.
One finding, one truth.
Every scanner result is correlated and deduplicated before it becomes a finding, using scanner-ref then SHA-1 fingerprint matching. When two tools report the same issue on the same asset, the team works one record with its full history, not three copies.
Every scanner, one queue.
PMAP ingests Nessus, Qualys, Rapid7, Acunetix, Invicti, SonarQube, Tenable.sc and more into a single finding model. It never trusts vendor severity blindly, so the risk picture stays consistent no matter how each tool rates its own results.
Findings get owned, not parked.
Each finding moves through a state machine with an assigned owner and an SLA deadline resolved from project, company, then global thresholds. Closure can sit behind four-eyes approval, so nothing terminal happens on a single person's say-so.
Built to be audited.
Tenant isolation, scoped RBAC and a compliance-grade event ledger are the baseline, not add-ons. PMAP records what was found, who owns it, when it is due and when it closed, because that is the evidence a security leader has to defend.
Why we exist
The pattern
We kept watching the same scene inside enterprise programs. A team running three to ten scanners at once, and the same vulnerability triaged five separate times because each console reported it on its own. The scanning was solved. The reconciliation never was.
The choice
A reporting layer over the existing scanners would have demoed well and changed nothing. So we made a harder call and started underneath the tools, at the layer where a finding is actually decided, rather than at the layer where it is merely displayed. The product follows from that one decision.
The line
We hold PMAP to a single uncomfortable standard. A program is not safer because a scan ran or because a report was emailed. It is safer only when the real work that follows a scan reaches an end. So that work, not the scan, is the thing the platform is measured against.
Ready when you are
Two ways in. Book a working demo and we will walk PMAP through a scenario that looks like your environment. Or open the company page first to see the team and the thinking behind the platform.
