To start at the bottom, the answer would be YES , in that would be ZENworks itself.  The Agent's are not stand alone and report to the ZENworks Primary Servers and results are stored in the DB.  The agents are not stand-alone objects.  Third party devices can query the DB which holds extensive details if some other product wants the same information.  ZENworks Reporting Server can be used to help generate the required queries for external information.

In General, For CVEs ZCM will only report if impacted software is installed and not analyze the configuration of the software, though administrators could indeed do that on a case by case basis if desired if they owned the full ZCM that allows for deeper dives and creating your own definitions. 

I would recommend not trying to equate what Tenable does with what ZCM does.  Very Different on so many levels.  

To start at the bottom, the answer would be YES , in that would be ZENworks itself.  The Agent's are not stand alone and report to the ZENworks Primary Servers and results are stored in the DB.  The agents are not stand-alone objects.  Third party devices can query the DB which holds extensive details if some other product wants the same information.  ZENworks Reporting Server can be used to help generate the required queries for external information.

In General, For CVEs ZCM will only report if impacted software is installed and not analyze the configuration of the software, though administrators could indeed do that on a case by case basis if desired if they owned the full ZCM that allows for deeper dives and creating your own definitions. 

I would recommend not trying to equate what Tenable does with what ZCM does.  Very Different on so many levels.  

Thank you Craig.
I am not completely clear yet.
However, now I do understand that ZENworks can only report on a vulnerability with a specific software version it is keeping track of, and it is not particularly actively doing a "whole system" scan.
Therefore, ZENworks cannot be a like-for-like replacement for Tenable/Qualys vulnerability assessment scanners?

Secondly, it is not very clear to me from your answer if ZENworks can receive feeds via API or other means the scan results (e.g., from Tenable/Qualys), however, I have inferred it CANNOT do so.

Lastly, I am also not clear on the distributed / solution for tiered architecture (or deployment) available in ZENworks.
I am interested in understanding how much the product can scale in a very distributed deployment, say 50 sites (each site having hundreds of workstation clients/server) with only one instance of a Central Management system.
In such a deployment, as mentioned earlier, can the Central Manager delegate (or have) an intermediary between the Agent and the "Brain/Central Manager" such that they are reporting (and policy is received) from the "decentralised managers"?

Thank you.
Damilola.