What the free Java Security Assessment reveals
Most larger organizations do not know exactly what runs in their Java estate. Java sits in third-party applications, in containers, on build agents, and on forgotten servers. While this was mainly a licensing question, an estimate was good enough. Now that the time to exploit keeps shrinking and AI is helping attackers further, it no longer is.
That is why, together with Azul, we offer a free Java Security Assessment. In as little as a few days you can have an overview of where your Java is most exposed and what to fix first. We explain what has changed in a separate article.
What a typical assessment reveals
- Licensing and security obligations. Which versions and installations carry obligations that often go untracked. This helps with audit readiness and can also save on license costs.
- Versions below the current patch level. Which versions are below the current Critical Patch Update (CPU) baseline, with known but fixable vulnerabilities.
- KEV exposure. Which versions are exposed to vulnerabilities from the Known Exploited Vulnerabilities catalog of the US agency CISA. These have documented exploitation in the wild, which is why Azul treats them as the highest priority.
- End-of-life versions in production. Whether unsupported versions such as Java 5, 6, or 7 run in production. New fixes are no longer routinely released for them.
The good news: risk tends to be concentrated
The scale of the problem can look alarming when it first shows up across thousands of instances. In Azul's experience, however, most of the risk often comes from just 2–3 Java versions. Instead of hundreds of separate tasks, fixing a few specific versions often improves the overall picture significantly. Without data, though, you do not know which ones they are.
What you get
| Output | What it is for |
|---|---|
| Executive dashboard | A view of your entire estate by risk tier, vendor, and Java version |
| KEV and CVE analysis | A comparison with the CISA KEV catalog and the NVD, showing real threats, not just theoretical ones |
| Risk by version | Which versions drive your exposure, and so where to focus remediation |
| End-of-life runtime overview | Which end-of-life versions run and in how many instances, both a security gap and a compliance risk |
| Patch gap overview | How far deployed versions are from the current CPU level, and what doing nothing means |
| Prioritized roadmap | Next steps ranked by impact: what to patch first and which runtimes to migrate away from |
How it works
- You contact us through a short form and we agree on the scope.
- Input data. The free assessment works from an overview of Java versions and quantities, anonymized and with no names. A report from your ITAM tool is enough. If you do not have an overview, Azul's tools can scan the environment. We will confirm beforehand what data that involves.
- Evaluation. Results are checked against the KEV catalog and the NVD and ranked by impact.
- Dashboard and next steps. You receive a personalized dashboard and we walk you through the results.
You arrange everything with Solutia. The analysis itself is carried out by Azul.
Who it makes sense for
- Organizations running a larger number of Java applications without an up-to-date overview of versions.
- Security teams that need input for prioritizing patches.
- Companies preparing for an audit or dealing with regulatory requirements such as DORA or NIS2.
- Teams that still patch reactively or rely on systems behind a firewall passing an audit.
You do not need to use Azul. The assessment covers your Java estate regardless of vendor.
What to do with the results
The assessment is free and carries no obligation. You can use the results on your own, in your security process, or as input for management. If you want to continue, we can help with a remediation plan, with Azul Core security-only updates, or with the broader Java Assessment, which also covers licensing and costs.
Keep in mind that the assessment is for informational purposes. It is not legal or professional security advice and does not replace your own security process.
Request the free Java Security Assessment or read the service details.
Is your Java ready for attacks in the AI era?
We will arrange a free Java Security Assessment for you. In as little as a few days you can see which Java versions carry the most risk, where patches are missing, and what to fix first.
- Free, with no obligation
- Results in as little as a few days
- Just versions and counts, anonymized