You open the incident queue, already drowning in false-positive alerts. Management is hooked on AI marketing and mandating use cases from above. And thousands of open vulnerabilities sit pending your manual tracking and remediation.
CVSS, EPSS, and KEV can be useful signals — but they only measure theoretical severity or probability, which will cause your team to drown in noise. We judge vulnerabilities by how attackers actually abuse them, not by labels — moving beyond legacy prioritization to ruthless risk filtering.
Most tools start from a label and explain it. We start from what an attacker actually does and reverse-engineer the rating from there.
Each submission walks a three-tier intelligence fetch and a friction audit of the attack path before a verdict is rendered. Roughly three minutes, anonymous, no quota.
CVE-ID or Tenable plugin. Validated, normalized, deduped against an in-flight cache so concurrent requests share work.
NVD → MITRE CVE.org → LLM web search. EPSS probability, KEV listing, vendor severity, and CVSS vector all folded in.
Each prerequisite evaluated — attacker position implied, reachable population narrowed. Severity adjusts per real-world constraint.
Upgraded, downgraded, or unchanged. Plus compensating controls, a verification script, and an SLA-bound bottom line.
Every report walks the real story, the attack path, the call (with confidence and reasoning), compensating controls, a verification script in the right language, and a Monday-morning action plan bound to SLA deadlines.
Every report renders the same seven panels — skim or dive, your choice. Each one answers a question a defender actually asks under pressure.
Introduce mitigation first. That creates space for operations to breathe while still reducing risk in a controlled way. The sweet spot is a tight mitigation target with a looser remediation target.
| Reassessed | Mitigation | Remediation |
|---|---|---|
| CRITICAL | ≤ 3 days | ≤ 90 days |
| HIGH | ≤ 30 days | ≤ 180 days |
| MEDIUM | — | ≤ 365 days |