The whole platform on your hardware, with no cloud half
- Runtime
- One desktop application. macOS, Apple Silicon.
- Source of truth
- One local SQLite database. 626 MB seed, 361,000+ CVEs, daily incremental sync.
- Inference
- cveasy-ai-v1, on-device. Zero cloud calls, no telemetry bus.
- Egress
- None. No upload path for scan data, findings, or reports.
Every flow terminates inside your network.
The complete topology of a production install. Threat feeds cross the boundary one way. Nothing you generate crosses it at all.
The dashed lane exists so you can look for it in a packet capture. There is nothing to find. No upload path for scan results, findings, or reports.
One machine runs the whole stack.
The application, the database, the scoring engine, the attack engine, and the AI model are one install on one Mac. No SaaS control plane, no collector VM, no agent rollout. This is the process list an architect can audit.
| Component | What it does | Where it runs | State lives in |
|---|---|---|---|
| Desktop app | UI, local REST API, connector scheduler | Your Mac · Apple Silicon | Local SQLite |
| CVE database | 361,000+ records from NVD, GHSA, OSV, and vendor feeds. Incremental daily updates, no API rate limits | In-process · local | SQLite · 626 MB seed |
| TRIS v2 engine | 12-layer scoring, re-scored continuously as intel refreshes. Patent pending | Local process | SQLite |
| BASzy engine | 158,271 payloads across 150 modules. Scope-enforced before execution, every run audit-logged | Local process | SQLite audit log |
| cveasy-ai-v1 | Runbook generation, 47 ms typical. Private RAG over your internal runbooks and standards | On-device inference | SQLite |
| MCP server | Typed agent tools for Claude Desktop and Claude Code | Local socket | Reads live SQLite |
| Endpoint agents | None. Nothing is installed on target hosts | — | — |
SQLite is the source of truth
Every finding, score, asset, and audit event lives in one local database. No cloud round-trips, no usage metering, no outage risk when a vendor API has a bad day.
seed 626 MB · 361K+ CVEs
air-gap mirror by removable media
The model is on-device
cveasy-ai-v1 generates the apply, verify, and rollback commands per CVE, per OS. Inference never leaves the machine, so your production config details are never in someone else's prompt log.
cloud calls zero
grounding private RAG, your runbooks
No agents, ever
Agentless discovery consolidates a local TCP service sweep, imported scanner exports, service fingerprints, and BASzy results into one deduplicated asset and attack-path graph. A second source of truth beside your enterprise scanner, not a replacement for it.
output one asset + attack-path graph
152 integrations, three lanes in
Every lane lands in the same normalized schema with full asset identity: hostname, IP, MAC, agent UUID. The same CVE reported by three tools becomes one exposure with three witnesses, and teams see around a 75% reduction in ticket volume once the same exposure stops arriving five times under five names.
Scoped, read-only credentials
Each client speaks the vendor's native API: cursor pagination, OAuth re-auth, OData joins. Paste a key, test it, pull immediately. EDR connectors also report which mitigating controls are live on each asset, feeding TRIS Layer 10.
also Snyk · SonarQube · GitHub · Okta · Entra ID · AWS · Azure · GCP · Shodan
sync 15 min to daily, auto
credentials AES-GCM, workspace-scoped
Drop the export, and format detection does the rest
Raw XML, CSV, or JSON is detected, parsed, and normalized on drop. No format negotiation, no mapping spreadsheet.
Anything that can POST can feed CVEasy
CI pipelines pushing Trivy and SARIF, DAST tools, one-off Nmap sweeps. Findings land normalized under the calling tenant's key, so MSSP client workspaces stay isolated.
limits 10 MB · 50,000 findings per request
Findings are matched on asset identity, not string similarity. One exposure, many witnesses: the scanner's finding, the EDR's control state, and the import's evidence all attach to the same asset record before TRIS ever scores it.
Eight feeds, cached locally, one database.
Everything CVEasy knows about the outside world syncs in and is stored locally. Scoring never waits on a network call, and disconnected installs stay current by mirrored bundle.
seed 626 MB · local SQLite
air-gap mirror by USB
score 0.00 to 1.00 · 30-day probability
feeds TRIS Layer 2 · cached locally
effect hard override in Layer 3
context federal mandate: 14 days
mapping APT-to-CVE + sector targeting
feeds TRIS Layer 6
used by BASzy modules + Layer 10
weighting freshness by BAS age
depth unlimited transitive
feeds TRIS Layer 9 · app rollups
split AWS 88 · Azure 61 · GCP 55
results stay in local instance
inputs sweep + exports + fingerprints + BASzy
output one asset graph
All five Gartner CTEM stages, one process.
Findings enter once, get classified, deduplicated, scored, validated, and leave as work with proof. Each stage below is a shipping capability, not a roadmap item.
Asset classification
Every asset auto-tagged by role, criticality tier, business owner, and compliance zone. Runs against service fingerprints and exposure signals, no manual spreadsheets.
feeds TRIS Layer 4
Normalize + dedupe
Field names normalized, findings deduplicated by CVE plus asset, each enriched with EPSS, KEV, and actor intel. A typical run: 47K findings in, 12K unique exposures out.
dedupe 4:1 cross-tool
TRIS v2 scoring
Twelve layers produce one 0 to 100 score per CVE per asset, re-scored continuously as intel refreshes. Five bands map straight to SLA commitments.
BASzy simulation
Real attack simulation, scope-enforced before execution and audit-logged, with dry-run mode. A critical your WAF blocks gets demoted. A medium proved exploitable gets boosted.
campaigns 10 pre-built APT
cveasy-ai-v1 fixes
The exact apply, verify, and rollback commands per CVE, per OS, grounded in a private RAG over your own runbooks. Generated locally, attached to every ticket.
latency 47 ms typical
Twelve layers, five of which exist nowhere else
TRIS v2 is the engine everything feeds into and out of. CVSS is deliberately one twelfth of the answer, weighted low so the contextual layers can matter. Layers 8 through 12 are patent pending.
| Layer | Dimension | Input | Behavior |
|---|---|---|---|
| L01 | Severity foundation | NVD CVSS v3.1 | Baseline, weighted low (8%) so it cannot dominate the composite. |
| L02 | Exploitation probability | EPSS · FIRST.org · daily | Heavily weighted. 30-day exploitation probability from real attacker telemetry. |
| L03 | Confirmed exploitation | CISA KEV | Hard override. Immediate boost the moment a CVE is listed. |
| L04 | Business impact | Stage 1 auto-classification | Crown / Prod / Staging / Dev tiers. A prod database outranks a dev laptop. |
| L05 | Network exposure | Topology + ports + services | Internet-facing vs internal vs air-gapped, detected automatically. |
| L06 | Threat pressure | 49+ APT groups + campaigns + your sector | Sector-aware boost when tracked actors use a CVE against your industry. |
| L07 | Temporal dynamics | Vuln age + exploit maturity + patch state | Continuous. Tracks exploit velocity and wormability so the list never fossilizes. |
| L08 | Attack path blast radiusNovel | Directed network graph | Lateral reach, pivot paths to crown jewels, proximity to Tier 1 assets. |
| L09 | Supply chain propagationNovel | SBOM · CycloneDX / SPDX | Transitive depth and breadth, plus whether a fixed version exists. Log4Shell hid four levels deep. |
| L10 | Defense efficacyNovel | ATT&CK v15 + BASzy results | Coverage per technique, freshness-weighted by validation age. Asks "can we stop this," not "how bad is this." |
| L11 | Predictive trajectoryNovel | PoC commit velocity, forks, chatter | 7-day look-ahead. Flags fast-movers before they reach the KEV catalog. |
| L12 | Financial impactNovel | FAIR + per-hour revenue | Primary, secondary, and productivity loss as a dollar figure the board engages with. |
One 0 to 100 score per CVE per asset · five bands: ACT / ATTEND / TRACK / MONITOR / INFO, each mapped to an SLA · five layers patent pending. Try it: TRIS Lab · TRIS Calculator · white paper.
Ten surfaces, all landing in your infrastructure
Scored intelligence is only useful where work happens. Every output below writes to something you already own: your tracker, your patch console, your SIEM, your machine.
Triage queue
Every scored exposure lands ranked by TRIS in a Kanban queue, filterable by band, asset, owner, or CVE. Tickets auto-route to the named owner for each asset category with SLA deadlines attached.
Remediation runbooks
Apply, verify, and rollback commands plus compensating controls, attached to every ticket as HTML, Markdown, and a shell-script bundle. Roughly 40% faster mean-time-to-remediate in our customer cohort.
Fix First patch orchestration
The generated fix deploys as a governed job through Intune, Automox, Tanium, Jamf Pro, PDQ Connect, or a universal webhook. Fail-closed gating, AES-GCM credentials, and a closed-loop re-scan that confirms the exposure closed. CVEasy never pushes patches to endpoints itself.
Ticketing & alerts
One click creates a mapped ticket in Jira Cloud, ServiceNow, GitHub Issues, Linear, or Monday.com. Lifecycle events (CVE discovered, KEV added, exploitability confirmed, patch deployed, control verified) push to Slack Block Kit, Teams Adaptive Cards, Discord, and PagerDuty Events v2 with dedup keys that auto-resolve on verified fix. SSRF-guarded and delivery-logged.
Claude MCP server
Typed tools for Claude Desktop, Claude Code, or any MCP client: posture queries, findings search, TRIS breakdowns, report rendering, work orders, scans, threat intel. CVEasy is a member of the Anthropic Claude Partner Network, and the connection never leaves your machine.
Executive reports
Board-ready PDFs on demand or on a weekly or monthly cadence, under your logo: risk trends, MTTR, SLA compliance, and FAIR-based dollar figures the audit committee can engage with.
Compliance evidence packs
Exposures and fixes mapped automatically to NIST CSF, NIST 800-53, SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, and CIS Controls. Evidence exports with dates, owners, actions, and validation results, on a cryptographically signed trail.
REST API
Every UI feature exposed over local HTTPS with token auth: ingest scans, trigger BASzy runs, query TRIS scores, export tickets. Local means no rate limits, no metering, no quota math.
SIEM forward
Material events (a new ACT-band exposure, a BASzy failure, a completed remediation) stream to Splunk, Sentinel, Elastic, or syslog as CEF, JSON, or native forwarder formats, so the SOC sees exposure state without switching tools.
TRIS v2 Calculator
A simplified client-side version of the scoring engine, public at tris-calculator. Plug in a hypothetical vulnerability and watch the twelve layers argue with CVSS.
Every destination is inside your boundary or under your account. The platform has no destination of its own.
Unplug it and it keeps scoring
The whole stack runs with the network cable out. Air-gap operation falls straight out of the architecture.
Built for rooms with no internet.
The CVE database ships as a 626 MB seed and updates by incremental bundle. EPSS and KEV cache locally, so scoring stays current between syncs. On disconnected networks, feeds arrive by removable media, and nothing needs to reach out because nothing is listening on the other end. Dedicated air-gapped builds run in DoD SCIFs, healthcare data-residency environments, and industrial control networks.
Sixteen capabilities, five platforms.
Every CVEasy cell is a capability shipping today. Every other column is what the market-leading alternative offers. No "partner integrations required" asterisks.
| Capability | CVEasy AI | Tenable One | Qualys TruRisk | Rapid7 InsightVM | Picus PXS |
|---|---|---|---|---|---|
| Vulnerability scanning | Import + agentless | ✓ | ✓ | ✓ | — |
| Multi-vendor connectors + normalization | 152 integrations, 16 categories | — | — | — | — |
| Multi-layer scoring | 12 layers | VPR (5) | TruRisk (5) | Risk Score | — |
| Attack path blast radius | Layer 8 | — | — | — | — |
| SBOM supply chain scoring | Layer 9 | — | — | — | — |
| Defense efficacy (ATT&CK coverage) | Layer 10 | — | — | — | Partial |
| Predictive threat trajectory | Layer 11 | — | — | — | — |
| FAIR-based financial quantification | Layer 12 | — | — | — | — |
| Built-in breach & attack simulation | 158,271 payloads | — | — | — | ✓ |
| AI remediation (per CVE, per OS) | Local LLM | — | — | Generic | — |
| Cloud posture (CSPM/CIEM) | Wiz-class, local | Add-on | Add-on | Add-on | — |
| Patch orchestration (through your consoles) | 6 providers | — | Own module | Own module | — |
| AI agent interface (MCP) | Native, local | — | — | — | — |
| Local-first / air-gapped capable | 100% | Cloud | Cloud | Cloud | Cloud |
| Flat-rate pricing (no per-asset fees) | Flat-rate | Per asset | Per asset | Per asset | Per node |
| Setup time | < 5 min | Weeks | Weeks | Weeks | Days |
See it running on your scan data.
A 30-minute live demo against your actual vulnerability backlog. Your data stays entirely in your environment. No trial, no installation, no procurement friction.