The whole platform on your hardware, with no cloud half
- Runtime
- One desktop application. macOS, Apple Silicon.
- Source of truth
- One local SQLite database. 626 MB seed, 328,000+ CVEs, daily incremental sync.
- Inference
- cveasy-ai-v1, on-device. Zero cloud calls, no telemetry bus.
- Egress
- None. No upload path for scan data, findings, or reports.
Every flow terminates inside your network.
The complete topology of a production install. Threat feeds cross the boundary one way. Nothing you generate crosses it at all.
The dashed lane exists so you can look for it in a packet capture. There is nothing to find. No upload path for scan results, findings, or reports.
One machine runs the whole stack.
The application, the database, the scoring engine, the attack engine, and the AI model are one install on one Mac. No SaaS control plane, no collector VM, no agent rollout. This is the process list an architect can audit.
| Component | What it does | Where it runs | State lives in |
|---|---|---|---|
| Desktop app | UI, local REST API, connector scheduler | Your Mac · Apple Silicon | Local SQLite |
| CVE database | 328,000+ records from NVD, GHSA, OSV, and vendor feeds. Incremental daily updates, no API rate limits | In-process · local | SQLite · 626 MB seed |
| TRIS 3 engine | Fitted, monotone scoring, re-scored on boot when the model changes and daily as intel refreshes | Local process | SQLite |
| BASzy engine | 158,271 payloads across 150 modules. Scope-enforced before execution, every run audit-logged | Local process | SQLite audit log |
| cveasy-ai-v1 | Runbook generation, 47 ms typical. Private RAG over your internal runbooks and standards | On-device inference | SQLite |
| MCP server | Typed agent tools for Claude Desktop and Claude Code | Local socket | Reads live SQLite |
| Endpoint agents | None. Nothing is installed on target hosts | — | — |
SQLite is the source of truth
Every finding, score, asset, and audit event lives in one local database. No cloud round-trips, no usage metering, no outage risk when a vendor API has a bad day.
seed 626 MB · 328K+ CVEs
air-gap mirror by removable media
The model is on-device
cveasy-ai-v1 generates the apply, verify, and rollback commands per CVE, per OS. Inference never leaves the machine, so your production config details are never in someone else's prompt log.
cloud calls zero
grounding private RAG, your runbooks
No agents, ever
Agentless discovery consolidates a local TCP service sweep, imported scanner exports, service fingerprints, and BASzy results into one deduplicated asset and attack-path graph. A second source of truth beside your enterprise scanner, not a replacement for it.
output one asset + attack-path graph
158 integrations, three lanes in
Every lane lands in the same normalized schema with full asset identity: hostname, IP, MAC, agent UUID. The same CVE reported by three tools becomes one exposure with three witnesses, and teams see around a 75% reduction in ticket volume once the same exposure stops arriving five times under five names.
Scoped, read-only credentials
Each client speaks the vendor's native API: cursor pagination, OAuth re-auth, OData joins. Paste a key, test it, pull immediately. EDR connectors also report which mitigating controls are live on each asset, and verified controls lower the TRIS likelihood.
also Snyk · SonarQube · GitHub · Okta · Entra ID · AWS · Azure · GCP · Shodan
sync 15 min to daily, auto
credentials AES-GCM, workspace-scoped
Drop the export, and format detection does the rest
Raw XML, CSV, or JSON is detected, parsed, and normalized on drop. No format negotiation, no mapping spreadsheet.
Anything that can POST can feed CVEasy
CI pipelines pushing Trivy and SARIF, DAST tools, one-off Nmap sweeps. Findings land normalized under the calling tenant's key, so MSSP client workspaces stay isolated.
limits 10 MB · 50,000 findings per request
Findings are matched on asset identity, not string similarity. One exposure, many witnesses: the scanner's finding, the EDR's control state, and the import's evidence all attach to the same asset record before TRIS ever scores it.
Eight feeds, cached locally, one database.
Everything CVEasy knows about the outside world syncs in and is stored locally. Scoring never waits on a network call, and disconnected installs stay current by mirrored bundle.
seed 626 MB · local SQLite
air-gap mirror by USB
score 0.00 to 1.00 · 30-day probability
feeds TRIS likelihood · cached locally
effect confirmed-exploitation floor into ACT
context federal mandate: 14 days
mapping APT-to-CVE + sector targeting
feeds TRIS confirmed exploitation (direct attribution)
used by BASzy modules + TRIS mitigations
weighting freshness by BAS age
depth unlimited transitive
feeds TRIS spread · app rollups
split AWS 88 · Azure 61 · GCP 55
results stay in local instance
inputs sweep + exports + fingerprints + BASzy
output one asset graph
All five Gartner CTEM stages, one process.
Findings enter once, get classified, deduplicated, scored, validated, and leave as work with proof. Each stage below is a shipping capability, not a roadmap item.
Asset classification
Every asset auto-tagged by role, criticality tier, business owner, and compliance zone. Runs against service fingerprints and exposure signals, no manual spreadsheets.
feeds TRIS asset context
Normalize + dedupe
Field names normalized, findings deduplicated by CVE plus asset, each enriched with EPSS, KEV, and actor intel. A typical run: 47K findings in, 12K unique exposures out.
dedupe 4:1 cross-tool
TRIS 3 scoring
One function produces a 0 to 100 score per CVE per asset, from exploitation likelihood plus asset context. Four bands map straight to SLA commitments.
BASzy simulation
Real attack simulation, scope-enforced before execution and audit-logged, with dry-run mode. A critical your WAF blocks gets demoted. A medium proved exploitable gets boosted.
campaigns 10 pre-built APT
cveasy-ai-v1 fixes
The exact apply, verify, and rollback commands per CVE, per OS, grounded in a private RAG over your own runbooks. Generated locally, attached to every ticket.
latency 47 ms typical
One fitted model, four stages, no denominator
TRIS 3 is the engine everything feeds into and out of. It replaced the TRIS v2 twelve-layer weighted mean in release 1.7.4, because a weighted mean can lower a score when a risk signal is added. In TRIS 3 each input moves the score only in its own direction. In a leave-one-date-out backtest it ranked later CISA KEV additions with ROC-AUC 0.89 to 0.92, against 0.67 to 0.73 for EPSS alone at the time.
| Stage | Component | Input | Behavior |
|---|---|---|---|
| S1 | Exploitation likelihood | EPSS · CVSS · age · network reach without auth · vendor reports | Logistic model of the chance a CVE is added to CISA KEV, fitted on four point-in-time snapshots. Risk coefficients are non-negative, and an unknown EPSS or CVSS takes the population average, so missing data never reads as safe. |
| S2 | Mitigation | Finding verdicts · verified EDR, WAF, MFA, segmentation · BASzy | Multiplies the likelihood down, never up. Blocked, not reachable, does not apply and patched verdicts weigh most. |
| S3 | Asset context | Stage 1 auto-classification · tags · exposure · spread | Fixed points for criticality, crown-jewel proximity, internet exposure, environment and spread. Unknown context adds nothing. |
| S4 | Confirmed exploitation | CISA KEV · documented actor · BASzy proof · observed here | Lifts the finding into ACT and keeps it ordered there. Only a finding-specific verdict can waive it. |
One 0 to 100 score per CVE per asset · four bands: ACT / ATTEND / TRACK / MONITOR, each mapped to an SLA · adding risk never lowers the score, enforced by tests. Try it: TRIS Lab · TRIS Calculator · v2 white paper.
Ten surfaces, all landing in your infrastructure
Scored intelligence is only useful where work happens. Every output below writes to something you already own: your tracker, your patch console, your SIEM, your machine.
Triage queue
Every scored exposure lands ranked by TRIS in a Kanban queue, filterable by band, asset, owner, or CVE. Tickets auto-route to the named owner for each asset category with SLA deadlines attached.
Remediation runbooks
Apply, verify, and rollback commands plus compensating controls, attached to every ticket as HTML, Markdown, and a shell-script bundle. Roughly 40% faster mean-time-to-remediate in our customer cohort.
Fix First patch orchestration
The generated fix deploys as a governed job through Intune, Automox, Tanium, Jamf Pro, PDQ Connect, or a universal webhook. Fail-closed gating, AES-GCM credentials, and a closed-loop re-scan that confirms the exposure closed. CVEasy never pushes patches to endpoints itself.
Ticketing & alerts
One click creates a mapped ticket in Jira Cloud, ServiceNow, GitHub Issues, Linear, or Monday.com. Lifecycle events (CVE discovered, KEV added, exploitability confirmed, patch deployed, control verified) push to Slack Block Kit, Teams Adaptive Cards, Discord, and PagerDuty Events v2 with dedup keys that auto-resolve on verified fix. SSRF-guarded and delivery-logged.
Claude MCP server
Typed tools for Claude Desktop, Claude Code, or any MCP client: posture queries, findings search, TRIS breakdowns, report rendering, work orders, scans, threat intel. CVEasy is a member of the Anthropic Claude Partner Network, and the connection never leaves your machine.
Executive reports
Board-ready PDFs on demand or on a weekly or monthly cadence, under your logo: risk trends, MTTR, SLA compliance, and FAIR-based dollar figures the audit committee can engage with.
Compliance evidence packs
Exposures and fixes mapped automatically to NIST CSF, NIST 800-53, SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, and CIS Controls. Evidence exports with dates, owners, actions, and validation results, on a cryptographically signed trail.
REST API
Every UI feature exposed over local HTTPS with token auth: ingest scans, trigger BASzy runs, query TRIS scores, export tickets. Local means no rate limits, no metering, no quota math.
SIEM forward
Material events (a new ACT-band exposure, a BASzy failure, a completed remediation) stream to Splunk, Sentinel, Elastic, or syslog as CEF, JSON, or native forwarder formats, so the SOC sees exposure state without switching tools.
TRIS Calculator
A simplified client-side model of the earlier TRIS v2 engine, public at tris-calculator. Plug in a hypothetical vulnerability and watch context argue with CVSS.
Every destination is inside your boundary or under your account. The platform has no destination of its own.
Unplug it and it keeps scoring
The whole stack runs with the network cable out. Air-gap operation falls straight out of the architecture.
Built for rooms with no internet.
The CVE database ships as a 626 MB seed and updates by incremental bundle. EPSS and KEV cache locally, so scoring stays current between syncs. On disconnected networks, feeds arrive by removable media, and nothing needs to reach out because nothing is listening on the other end. Dedicated air-gapped builds run in DoD SCIFs, healthcare data-residency environments, and industrial control networks.
Fourteen capabilities, five platforms.
Every CVEasy cell is a capability shipping today. Every other column is what the market-leading alternative offers. No "partner integrations required" asterisks.
| Capability | CVEasy AI | Tenable One | Qualys TruRisk | Rapid7 InsightVM | Picus PXS |
|---|---|---|---|---|---|
| Vulnerability scanning | Import + agentless | ✓ | ✓ | ✓ | — |
| Multi-vendor connectors + normalization | 158 integrations, 15 categories | — | — | — | — |
| Context-aware risk scoring | TRIS 3 | VPR (5) | TruRisk (5) | Risk Score | — |
| Spread and blast radius in the score | TRIS 3 context | — | — | — | — |
| Shared dependency in the score | TRIS 3 context | — | — | — | — |
| Verified controls lower the score | TRIS 3 mitigation | — | — | — | Partial |
| Built-in breach & attack simulation | 158,271 payloads | — | — | — | ✓ |
| AI remediation (per CVE, per OS) | Local LLM | — | — | Generic | — |
| Cloud posture (CSPM/CIEM) | Wiz-class, local | Add-on | Add-on | Add-on | — |
| Patch orchestration (through your consoles) | 6 providers | — | Own module | Own module | — |
| AI agent interface (MCP) | Native, local | — | — | — | — |
| Local-first / air-gapped capable | 100% | Cloud | Cloud | Cloud | Cloud |
| Flat-rate pricing (no per-asset fees) | Flat-rate | Per asset | Per asset | Per asset | Per node |
| Setup time | < 5 min | Weeks | Weeks | Weeks | Days |
See it running on your scan data.
A 30-minute live demo against your actual vulnerability backlog. Your data stays entirely in your environment. No trial, no installation, no procurement friction.