← All use cases
Use case · Free + Commercial

Exposure Management Leads

Build a defensible monthly exposure metric from public data. One number your CISO can act on.

Every month, Chen walks into a CISO meeting with one number. Not patch rate, not mean time to remediate, not scanner coverage. Those describe the programme. This number describes the threat, and it is built from public data she can defend to a regulator without citing any vendor’s scoring model.

The number is defensible because it is sourced from publicly verifiable facts: CISA’s own catalog and public exploit repositories.

Free tier
What you get
The daily snapshot plus KEV context (due date, required action, known_ransomware_campaign_use), joined against a CMDB export.
What you do
Two filters: CVEs with a CISA KEV inclusion present in the environment (the KEV overlap), then narrow to those that also carry a Metasploit or ExploitDB reference. A third cut: where known_ransomware_campaign_use is true.
Outcome
One headline number (KEV-listed, weaponized, present) tracked month over month. Up means the threat is outpacing remediation; down means the programme is winning. Twenty minutes on meeting morning, sourced from public facts.
  • Daily snapshot
  • KEV context: due date, required action, ransomware flag
  • Free API key
Commercial
What you get
The commercial feed's classification, queryable: lifecycle_stage, severity_band, current_trend, signal_velocity, compound_risk, and evidence.what_changed.
What it does for you
Two numbers instead of one. First: Confirmed Critical CVEs in the environment (lifecycle_stage=Confirmed & severity_band=Critical, deterministic, same evidence always the same verdict). Second: how many of those are Escalating with High velocity.
Outcome
The metric now shows state and direction of travel: not just “we have exposure” but “it is getting worse, specifically these CVEs, this fast,” with the evidence narrative behind each. The CISO reads an explanation, not a number.
  • lifecycle_stage · severity_band · current_trend · signal_velocity
  • compound_risk.strength_tier for corroboration
  • evidence.what_changed for the CISO narrative
  • Direction of travel, not just current state

The free tier gives you observable facts. The commercial platform turns those facts into an explainable exposure signal: what changed, why it matters, and what to do next.

Get a free key See pricing →