In Balbix, product states describe the overall security posture of a software component by summarizing the status of all vulnerabilities that affect it. These states are used in filters and dashboards to quickly assess which components require attention.
Each product component—such as an operating system, application, library, or firmware version—is evaluated independently. A component can only be in one state at a time.
Patched
All relevant security fixes have been successfully applied to the component. There are no known vulnerabilities currently affecting this version. This is the desired state for all managed software components.
Unpatched
The component has at least one vulnerability with a known fix that has not been applied. The Balbix platform recommends a strategic fix, typically the most effective patch or version upgrade that addresses all outstanding issues.
Vulnerable
The component has known vulnerabilities, but no vendor fix is currently available. This typically occurs in the case of zero-day vulnerabilities or issues pending patch release. Risk reduction must rely on compensating controls.
Unknown
The platform cannot determine the state of the component due to insufficient versioning data or incomplete scan results. These components should be treated with caution until full assessment is possible.
EOL (End-of-Life)
The component is no longer supported by the vendor, meaning it will not receive security updates or patches for newly discovered vulnerabilities.
How States Are Assigned
Product states are calculated automatically based on vulnerability and patch data:
If any fixable vulnerability exists, the component is Unpatched.
If vulnerabilities exist without available fixes, the component is Vulnerable.
If no vulnerabilities are found, it is Patched.
If version data is missing or the scan failed, it is Unknown.
If the component is no longer supported by the vendor, it is marked as EOL, regardless of whether vulnerabilities are present or patched.
Summary
Balbix uses four product states to describe the security posture of software components:
Patched – All known vulnerabilities are resolved
Unpatched – Fixable vulnerabilities are present
Vulnerable – Vulnerabilities exist but no fixes are available
Unknown – Insufficient data to determine state
EOL - The component is no longer supported
These states enable prioritization of remediation efforts and help track risk across your software inventory.
See Also: