Two-Axis Exploit Scoring
Every vulnerability is rated on two axes — the impact it carries in your industry, and hard evidence that it's actually being exploited — then fused into one transparent, explainable score. No black box, no EPSS guesswork.
- Industry impact × evidence-based threat
- Deterministic and fully explainable — every score shows its reasons
- Ranks findings far beyond a static CVSS base score
- Configurable weights and thresholds to match your risk tolerance
Evidence-Based Threat Intelligence
Priority is driven by what's happening in the real world, not by probability estimates. Exploit Score watches the signals that prove a vulnerability is a live threat.
- CISA Known Exploited Vulnerabilities (KEV)
- Active ransomware campaign association
- Public exploit availability & NVD enrichment
- ML Exploit Intelligence lens re-ranks findings vs. CVSS
POA&M & Remediation Tracking
Turn scores into accountable action. Exploit Score auto-generates Plans of Action & Milestones, assigns team ownership, and tracks every remediation against its deadline.
- Auto-populated POA&M with points of contact per subnet/team
- Configurable fix-by deadlines and overdue tracking
- Milestone tracking with a personal “My POA&M” view
- One-click FedRAMP POA&M Excel export
Exemptions, Waivers & Deviations
Not every finding can be fixed on the clock. Analysts request a documented exemption, waiver, or deviation, and every selected approver must sign off before it takes effect — with a full audit trail.
- Request & approval workflow with multi-approver sign-off
- Human-readable exemption references (e.g. ABC-2026-08-0001)
- Exempted findings excluded from scores, POA&M & compliance
- Awaiting-approval, active, rejected & my-requests views
Patch Compliance & Framework Mapping
Measure how well unpatched vulnerabilities are being remediated within each framework's required timeframes — scored and weighted by severity so critical gaps carry the most weight.
- Severity-weighted compliance score (critical rules count 4×)
- PCI-DSS, HIPAA, and SOC 2 control mapping
- Industry-specific rule sets and custom frameworks
- Per-rule pass/fail visibility with non-compliant asset drill-down
BOD 26-04 & SSVC
Meet CISA Binding Operational Directive 26-04 head-on. Exploit Score classifies findings with the SSVC decision model, tracks remediation SLAs, and runs a guided forensic triage for the 3-day-forensic bucket.
- SSVC classification into 3-day, 14-day, and 60-day buckets
- Remediation SLA clocks with overdue and due-soon alerts
- Guided 9-step forensic triage with cross-team assignees
- Evidence upload and escalation decisions per case
Network Vulnerability Map
See your risk as a topology, not a spreadsheet. Every subnet and asset is mapped and color-coded by exposure, so you can spot the hotspots at a glance.
- Interactive subnet and device topology
- Filter by exploitable, CISA KEV, critical ETS, or active ransomware
- Per-device risk counts and drill-down
- AI insights per subnet
Scheduled Reports & Security Hub
Get the right picture to the right people. Send on-demand or recurring reports by email, and build a personalized Security Hub from dozens of drag-and-drop widgets.
- Executive, deadline, POA&M, patch-compliance & BOD report types
- Daily, weekly, or monthly scheduling to teams or individuals
- Customizable Security Hub with team-filtered widgets
- Conversational “Ask Echo” assistant over your live data
