oolak
Live demo Free 14-day trial →
Asset and risk management

See every asset. Fix what matters. Know it's really fixed.

oolak brings your scanners, inventory, cloud and ticketing into one place. It puts real risk first, hands the work to the right team and checks with a fresh scan that every fix held.

Start a free 14-day trial → See how it works
  • It works with the tools you already have.
  • A finding only closes after its host is scanned again.
  • It runs on your own servers, and your data never leaves them.
A home page that shows where you stand today.
Sound familiar?

Finding vulnerabilities is easy. Getting them fixed is the hard part.

01

The tools are scattered and the data doesn't match.

Scanners, inventory, cloud accounts and ticketing systems work without knowing about each other.

  • The same server shows up with a different name in every system.
  • Teams spend hours matching records by hand in Excel.
  • Nobody is quite sure which team owns which server.
02

There are too many findings to know what to fix first.

Every scan brings thousands of findings, and they all look urgent.

  • Sorting by severity alone leads to the wrong priorities.
  • Reports don't say what can be reached from the internet.
  • How much a system matters to the business is left out.
03

Some risks stay hidden, and some fixes aren't real.

Forgotten services go unnoticed, and nobody checks whether "fixed" really means fixed.

  • Old test servers stay open to the internet for years.
  • A server that was off on scan day looks perfectly clean.
  • At audit time there is no approved record of risk decisions.
How it works

One simple loop, from discovery to proof.

oolak doesn't replace your tools. It connects them and keeps every problem moving until it is really solved.

Know everything you own, inside and out.

Your inventory, cloud accounts and scanners come together in one list. oolak also finds the domains, servers and certificates that anyone on the internet can reach, and links each one to its owner.

Asset inventory    Attack surface
Everything visible from the internet, with its owner.

Put the few problems that matter at the top.

Every finding is scored by whether attackers are using it, how important the system is and whether it can be reached from the internet. Thousands of findings become a short list your teams can finish.

Risk-based prioritisation
Every finding with its risk score, exploitation data and owner.

Let routine work run on its own.

Syncs, scans, tickets, reports and AI summaries run as workflows you build without code. Anything that changes a system waits for a person to approve it.

Workflows
Every workflow run, step by step, as it happens.

Give every problem an owner and a deadline.

Rules send each finding to the right team and open the ticket in the tool they already use. What can't be fixed today becomes an approved, time-limited exception.

Assignment    Exceptions
Approved, time-limited exceptions in one register.

Call it fixed only when it is fixed.

oolak remembers which hosts every scan reached. A finding closes only when its host was scanned and the problem was gone, and a quick rescan confirms each fix.

Verified closure
A targeted rescan confirms the fix.
Use cases

Questions oolak answers every day.

Urgent vulnerabilities

A critical vulnerability is in the news. Are we affected?

Find every affected system in minutes, scan just those systems and track the fix until it is confirmed.

See how it works Shadow IT

Which of our servers has everyone forgotten about?

Bring forgotten test servers, old subdomains and unmanaged hosts to light, and give each one an owner.

See how it works Prioritisation

We have thousands of findings. Where do we start?

Turn an endless list into a short one, ranked by real threat, business importance and internet exposure.

See how it works Verification

The ticket says fixed. Is it really?

Confirm every fix with a fresh scan, and never close a finding just because a server was offline.

See how it works

See all use cases

Relationship map

Follow the path from the internet to your data.

Domains, IP addresses, certificates, servers and applications are linked on one map. You can follow a public name to the server behind it and see which problems are waiting there.

  • The attack path view shows the route from the outside in.
  • A server behind a WAF or CDN is weighed differently from one that faces the internet directly.
  • The same map opens on every asset, application and team page.

Explore the relationship map

From a public name to the server behind it, and the problems waiting there.
Why oolak

It doesn't stop at a list. It follows each problem until it is solved.

It protects what you've already bought.

Your scanner, inventory and ticketing system stay where they are. oolak connects them, and you choose which source to trust for each piece of data.

It proves every fix.

A finding on a server that wasn't scanned never closes, and a problem that comes back is reopened automatically.

It sees risk in context.

Exploitation data, the importance of the system and its exposure to the internet are weighed together, using weights you control.

Your data stays with you.

oolak runs entirely on your own servers, even without an internet connection, and records every action in an audit log.

Reporting

Show progress with real numbers.

Every scan adds to a trend you can trust. Leaders see how fast problems are fixed, and every team gets a summary of its own work.

  • Average fix time, finding age and reopen rate are tracked over time.
  • Deadlines and breaches are shown for every severity.
  • Scorecards compare teams, sites and groups side by side.
  • Each team receives an e-mail summary with only its own data.

Explore reporting

Trends of new and fixed findings, straight from your scan history.
Runs on your servers.oolak installs inside your network, including networks with no internet access.
Works with your tools.76 scanners, inventories, cloud platforms and ticketing tools connect out of the box.
Closes only what was checked.A finding closes only after its host is scanned again and the problem is gone.
Records every action.Who did what and when is written to an audit log your SIEM can read.
Integrations

Works with the tools you already have.

See all 76 integrations

AI assistant

Ask your security data a question in plain language.

Connect the AI assistant you already use, or a model running inside your own network, and ask "which internet-facing servers have critical problems this week?". The assistant works with your permissions and can never approve anything on its own.

Meet the AI assistant

  • Assistants such as Claude connect through the built-in MCP server.
  • Local models keep everything inside your network.
  • Workflows call AI models to summarise findings and suggest decisions.
  • Every AI action is marked separately in the audit log.
Free 14-day trial

See your real risk picture in two weeks.

We set oolak up in your environment and work through it with your team. Here is what the two weeks look like.

Day 1

Connect

Your scanner, inventory or cloud and your ticketing system are connected, and the first sync runs.

Day 3

See the attack surface

Once the scope is confirmed, exposed names, certificates and unknown servers come to light.

Day 7

Set priorities and owners

A short list emerges, and assignment rules give every task an owner.

Day 14

Prove the first fixes

The first fixes are confirmed with targeted rescans, and scanning gaps are reported.

See oolak on your own data in 14 days.

We install oolak in your environment, connect your tools and show you your real risk picture. You keep everything it finds.

Start a free 14-day trial → Try the live demo
For engineers

Technical details

What is oolak, in technical terms?
oolak is an on-premises risk-based vulnerability management (RBVM), cyber asset attack surface management (CAASM) and external attack surface management (EASM) platform. It ingests findings and assets through typed connectors, keeps a durable life cycle per target, port and plugin, and orchestrates scans, tickets and notifications.
What are the system requirements?
Minimum requirements are 4 vCPUs, 16 GB of RAM, and 100 GB of SSD storage on any standard Linux distribution with Docker or Podman. All dependencies and frontend assets are fully bundled, enabling 100% air-gapped offline deployment without outbound internet access.
Can I integrate my own scripts and tools?
Yes. You can run custom Python, Bash, or PowerShell scripts via Orchestra automation workflows, trigger scans or remediation tasks through webhooks, feed custom vulnerability outputs via generic JSON/CSV parsers, and interact directly through the CLI.
Can I integrate oolak with my own applications and AI tools?
Yes. oolak provides a high-performance REST API v2 with Swagger documentation and token authentication for seamless integration with your internal portals and CI/CD pipelines. It also features a native Model Context Protocol (MCP) server for enterprise AI agents and full support for on-premise local LLMs (such as Ollama and vLLM) so your vulnerability data never leaves your infrastructure.
How does oolak decide that a finding is fixed?
Each sync records scan coverage for every host the scanner reached, including clean hosts. A missing finding is closed as remediated only if its host is in that coverage; otherwise it stays open and is flagged as not scanned. Findings that return are reopened, and decommissioned assets close with their own status.
How is access controlled?
Three layers: module access per role, fine-grained capabilities such as approval rights per area, and row-level scope by tenant and access group. Sign-in supports LDAP, Active Directory, SAML 2.0, OIDC and multi-factor authentication, and API tokens are scoped and rate-limited.
Which standards does it help with?
Findings map to ISO 27001, PCI DSS and NIST 800-53 controls, and regional frameworks such as BDDK and KVKK can be added. The audit log is written as RFC 5424 syslog, ready for Splunk or any SIEM.