Vulnetix
Try Vulnetix Request Demo
Risk Prioritization

Your queue, in your order.

Sorting a backlog by severity ranks it for somebody who has never seen your deployment. Vulnetix ranks open findings against an ordered rule strategy your organisation owns: malware, four KEV catalogues, weaponized exploits and live sightings, whether the vulnerable code is reachable, whether a finding traces to a line you can open, chained attack paths across CVSS vectors and MITRE ATT&CK, prediction models, vendor impact, and the scores your own analysts set. Drag the rules into the order your risk manager decides, save, and every priority view re-ranks against them. This is Risk-Based Vulnerability Management (RBVM) you control, not a fixed vendor score.

Ten findings from one organisation show the difference. A malicious package has no vendor CVSS at all, so a severity sort puts it last of ten; this organisation's strategy puts it first, because the first rule it matches is Known malware.

Request a Demo

The signals you can rank

A rule is only worth dragging if the data behind it exists for every finding, every day. These are the signals available to a strategy today, with examples of the feeds that supply them.

Evidence

Known malware

OpenSSF Malicious Packages (OSV MAL), OpenSourceMalware, Vulnetix Malscan, VDB malware advisories

The dependency itself is hostile rather than merely vulnerable. The system default ranks this above everything else, and most organisations leave it there.

Evidence

KEV catalogues

CISA KEV, ENISA EU KEV, Vulnetix KEV, VulnCheck KEV

Four catalogues, four separate rules, so you decide whether an ENISA EU listing carries the weight of a CISA one. The shipped default reads them in that order, and Vulnetix KEV is our own evidence-driven catalogue for exploitation the authority lists have not reached yet.

Evidence

Weaponized exploit

Metasploit modules, Nuclei templates, Snort rules, Nmap NSE scripts

Someone has packaged the vulnerability into a tool that runs. No research phase required, just a target list.

Evidence

Active exploitation

CrowdSec honeypots, Shadowserver Foundation, CIRCL and MISP sightings

Attack traffic observed against real sensors, with a first-seen date kept on the signal. This is the rule that separates "could be attacked" from "is being attacked".

Evidence

PoC exploit

Exploit-DB, VulnCheck XDB, GitHub PoCs, 0day.today, HackerOne and Bugcrowd disclosures, Project Zero 0day in the wild

Public proof the vulnerability is reachable in practice. Weaker than a packaged module, far stronger than a CVSS vector on its own.

Evidence

Reachability

Vulnetix CLI tree-sitter reachability, semantic grep, symbol fallback

Whether the vulnerable routine is actually called from your code, not merely present in your lockfile. The CLI assesses a CVE against your call graph and records what it found. "Assessed unreachable" is a separate rule from "reachable", on purpose, because a finding nobody has looked at is not the same as one you have ruled out.

Evidence

Traceability

SARIF locations from the Vulnetix CLI SAST and secret scanners, repo insights call graph

A code finding that resolves to a real file and line range is one an engineer can act on this afternoon. A stronger rule adds the call graph: the file the finding sits in is reached from something that runs. Two rules rather than one, so a graph-confirmed path can outrank a merely located one.

Prediction

EPSS and Coalition ESS

EPSS (FIRST), Coalition ESS

Two models answering two different questions, which is why they get separate rules. EPSS asks whether an exploit for this CVE will surface publicly in the next 30 days. Coalition ESS asks whether attackers are using it now. A CVE can score low on one and high on the other, and the rule you put first decides which of those worries you more.

Impact

CVSS, CWSS and your own scores

NVD and CNA CVSS, CWSS, Custom CVSS, Custom CWSS

CVSS rates the vulnerability and arrives the same for everyone. CWSS rates the underlying weakness and is built to be tailored to your environment. Custom CVSS and Custom CWSS are the same scales after your analysts re-score them, which is how a critical that is not reachable in your deployment comes down and a medium in a payment path goes up.

Chained

Attack path

CVSS v2, v3 and v4 vectors, MITRE ATT&CK techniques and tactics, reachability and exploitation evidence

One CVSS metric rarely changes a priority. Chain AV:N, PR:N and UI:N and you have described an attack somebody can mount today, unattended, from anywhere. Add an ATT&CK technique or reachability as a third link and the rule fires only on the findings that carry the whole path.

Catch all

All remaining

Ordered oldest first

Everything the rules above did not match. Exactly one of these, always pinned at the bottom, so nothing quietly falls out of the queue.

Those feeds are samples, not the list

Naming a handful of sources per rule keeps the explanation readable. The real inputs run much wider, because prioritisation is only as good as the enrichment sitting behind each finding. The Vulnetix VDB is the largest global collection of vulnerability and patch data: 160+ upstream authorities, aggregated, normalised and cross-referenced, covering vulnerabilities, exploits, patch reality, malware and end-of-life across 47+ ecosystems.

How a strategy works

Every organisation starts on a read-only system default of 23 rules, with exploitation evidence at the top, org-owned scores next, and prediction and vendor impact underneath. Clone it to edit. Each rule is one signal plus an operator: evidence signals match on presence, score signals take a comparison or a range. Drag a rule and its position becomes its priority, 0 being highest, and a finding inherits the tier of the first rule it matches. One rule stays pinned at the bottom, All remaining, which sweeps up whatever the rules above did not catch, oldest first. Once activated, the ranking applies wherever the queue appears: the What to fix first view, the dashboard priority widget, and the findings API.

Read the launch write-up in the Risk Prioritization announcement, see how the exploitation catalogue is built in Vulnetix KEV, or read how the maturity tiers are graded in Exploit intelligence signals.

Request a Demo →