Kaspersky Vulnerability Management Added to Russia's Ministry of Digital Development Software Registry

On 12 October 2026, it emerged that Kaspersky Vulnerability Management, Kaspersky's solution for centralized vulnerability discovery and management, has been added to the registry of domestic software. CNews published the report. A registry listing does not change the product's technical capabilities. It does change the product's position on the market: for some customers, the listing turns from a nice bonus into a mandatory purchase requirement.

What we know about the product

Vulnerability Management belongs to a class of systems that scan infrastructure, find outdated and vulnerable software, assess risks, and help prioritize fixes. The main value of such systems is centralization. Instead of a collection of separate scanners and spreadsheets reconciled by hand, the security team gets one console and one task list for the IT department.

The source's short note contains no technical details. It does not give the registry entry number, the product version, the date of the decision, or the number of supported platforms. Customers will have to confirm these details separately, in the registry itself and with the vendor.

In brief, here is what is confirmed:

• Product: Kaspersky Vulnerability Management.
• Developer: Kaspersky.
• Purpose: centralized vulnerability discovery and management.
• Event: registration in the domestic software registry.
• Source and publication date: CNews, 12 October 2026.
• Not disclosed: entry number, version, list of supported systems, pricing.

Why the registry matters

The Ministry of Digital Development maintains the registry of Russian software. A listing works as a pass into several market segments. State and quasi-state customers must give preference to domestic software when buying, and entities operating critical information infrastructure face restrictions on using foreign software at significant facilities. For a vendor, this is a question of access to tenders. For a customer, it is a way to meet regulators' requirements without lengthy approvals of exceptions.

It is also a signal for the vulnerability management market. The segment is crowded: Russian developers compete there alongside integrators who build solutions around open-source scanners. When a major player gets official domestic software status, competitors have fewer arguments for "gray" workaround schemes, and customers have fewer reasons to put off replacing foreign scanners.

What customers should do

The practical steps for choosing such a product are straightforward.

• Find the registry entry and check that it names exactly the edition and version you are being offered. Sometimes the registry lists one product line while the commercial proposal covers another.
• Check how the product works with your systems: operating systems, hypervisors, network equipment, container environments, domestic Linux distributions. Coverage determines how many vulnerabilities you will see at all.
• Find out which knowledge bases the scanning relies on. For Russian infrastructure, the international CVE database matters, but so does data from the FSTEC BDU (Threat Information Security Database).
• Find out whether the solution can do more than find vulnerabilities: can it prioritize them based on real-world exploitation, and how does it pass tasks to IT systems? A list of thousands of critical findings with no priorities is useless.
• Request a pilot on a limited network segment and look at the false positive rate and the time a full scan takes.

The main takeaway from the news is a pragmatic one. Registry listing removes one barrier for the customer, but the choice of a vulnerability management system still comes down to infrastructure coverage, the quality of prioritization, and how quickly the vulnerabilities found actually get closed.