← All use cases
Use case · Free + Commercial

Security Researchers

Pull exploitation timelines across hundreds of CVEs from a single reproducible daily dataset.

Alex is preparing a paper on exploitation velocity: how quickly a CVE moves from first public evidence to confirmed active exploitation. She needs a dated, reproducible timeline for every CVE, with sources she can cite and a method anyone can re-run.

Anyone with a free key can run the same query against the same snapshot and get the same result.

Free tier
What you get
The snapshot’s dated timeline per CVE: first GitHub PoC, ExploitDB entry, Metasploit module, KEV inclusion. Every event dated, every source named, with a navigable reference_id (repository path, module path, ExploitDB id).
What you do
She computes intervals (first PoC to weaponization, weaponization to KEV) across CVE categories, CVSS ranges, and vendor classes, citing the exact artifact via reference_id, not just the source name.
Outcome
Reproducible and citable: same key, same snapshot, same result. For longitudinal work, researchers retain the daily snapshot over time under the data license, or use the current snapshot for point-in-time analysis. (NVD publication date is not in the free tier; pair with NVD’s API if you need it.)
  • Dated observation events
  • Navigable source reference IDs
  • Retain daily snapshots over time under the data license
  • Free API key
Commercial
What you get
The interpretation layer: pre-computed threat_age_days, weaponization_age_days, time_since_last_material_change_days, and signal_velocity, deterministic and consistent across the whole corpus.
What it does for you
Pull the lifecycle transition history via GET /v1/signals/{cve}/history: not just when a CVE entered each stage but what evidence drove the transition. An Emerging-to-Active move via an EPSS delta then a PoC has a different profile than a direct jump to Confirmed via KEV.
Outcome
The intervals she derived by hand come pre-computed, and the classification fields (lifecycle_stage, confidence, compound_risk) make correlations tractable: does a CWE category or ATT&CK technique predict faster weaponization? Same academic license, richer data.
  • Pre-computed temporal intervals
  • Full history via /v1/signals/{cve}/history
  • Lifecycle transition evidence
  • Classification fields as query filters

The free tier gives you observable facts. The commercial platform turns those facts into an explainable exposure signal: what changed, why it matters, and what to do next.

Get a free key See pricing →