← All use cases
Use case · Free + Commercial

SOAR Engineers

Enrich every vulnerability alert with exploit evidence and ATT&CK mapping in a single API call.

Mike maintains the vulnerability alert playbooks for a mid-sized security team. Before ESIP, every alert triggered the same path: create a ticket, assign it to a queue, wait for an analyst to research it manually.

That research step took fifteen minutes to an hour per CVE: is there a weaponized exploit, what ATT&CK technique does it map to, has it been confirmed in the wild? Multiplied across hundreds of alerts a week, it was the most expensive part of triage.

The first routing decision becomes deterministic and automated. Analysts spend their time investigating, not enriching tickets.

Free tier
What you get
One call per alert: GET public.exposuresignal.io/v1/cves/{cve}, a low-latency cached lookup. The observation events, the exploit references, and the ATT&CK technique.
What you do
The playbook routes on presence: KEV inclusion goes P1 on-call; a Metasploit or ExploitDB reference goes P2 senior analyst; GitHub PoC only goes to the standard queue with context attached. The ATT&CK technique is written to the ticket automatically.
Outcome
First routing decision automated with a simple implementation. The analyst who picks up the ticket already knows the technique and the evidence. They investigate instead of enriching.
  • Live API at public.exposuresignal.io
  • Single GET per alert
  • Free API key
Commercial
What you get
GET api.exposuresignal.io/v1/signals/{cve}: the verdict directly. lifecycle_stage, confidence, compound_risk.strength_tier, current_trend, signal_velocity, and evidence.what_changed.
What it does for you
Route on the verdict, not on source names. Confirmed + Verified goes P1 on-call; Confirmed + High goes P1 senior; compound_risk Strong elevates a tier; Escalating + High velocity adds an urgency flag. what_changed pre-populates the ticket body.
Outcome
The routing logic is stable: a new exploit source appearing tomorrow doesn't break it. The verdict absorbs the new evidence and the rule reads the same field. Analysts work this week's real risks, not findings that were severe three months ago and never moved.
  • lifecycle_stage + confidence as stable routing fields
  • compound_risk.strength_tier for priority elevation
  • current_trend + signal_velocity for urgency flags
  • evidence.what_changed for the ticket body

The free tier gives you observable facts. The commercial platform turns those facts into an explainable exposure signal: what changed, why it matters, and what to do next.

Get a free key See pricing →