Threat intelligence
Whether anyone is actually exploiting this, so "critical" means something.
A CVSS score describes how bad a vulnerability would be if exploited. It says nothing about whether anyone is exploiting it, and treating a theoretical critical the same as one being used in the wild this week is how security backlogs become unmanageable.
What each finding carries
- CISA KEV and EU KEV membership: confirmed exploitation in the wild, with the remediation deadline for US federal agencies
- EPSS: the probability of exploitation in the next 30 days
- Exploit maturity: none, proof of concept, functional, or weaponised, from Metasploit, ExploitDB, Nuclei, VulnCheck and public repositories
- In-the-wild sightings: observed attack traffic, with source addresses, autonomous systems and geography
- ATT&CK mapping: the techniques an attacker gains
- SSVC: a decision rather than a number, with Act, Attend, Track and Defer
Filtering by it
{ "vulnetix.qualityGate.exploits": "weaponized" }
Ten weaponised vulnerabilities you can actually work through beats three hundred theoretical ones you cannot.
The intelligence browser
A panel for looking things up directly, without leaving the editor: search by CVE, GHSA, package or CWE, and get the full picture including indicators of compromise, detection rules for Snort, Suricata, YARA and Nuclei, and vendor trends.
Select a CVE identifier anywhere in a file and run Vulnetix: Look Up Selection, which is the fastest way to answer “what is this thing my colleague pasted in the ticket”.
Reachability
Signed-in organisations get reachability analysis: whether the vulnerable function is actually called from your code, traced through the call graph.
A vulnerability in a code path you never execute is real but not urgent. Being able to tell the difference is usually the largest single reduction in a security backlog.