CVEasy AI Documentation

Everything you need to set up, configure, and get the most out of CVEasy AI — the first complete CTEM platform.

Installation & Setup

First Steps After Installation

Once CVEasy AI is running, here's what to do first:

Option A: You have existing scan data

If your team runs Nessus, Qualys, Rapid7, or any other vulnerability scanner, import your most recent scan:

1. Click Scan Imports in the sidebar
2. Click Import Scan
3. Upload your scan file (drag & drop or file picker)
4. CVEasy auto-detects the format, creates assets, and links CVEs

Option B: You don't have scan data

No scanner? No problem. BASzy discovers your assets automatically:

1. Click BASzy in the sidebar
2. Click New Scan
3. Enter your network range (e.g., 10.0.0.0/24)
4. BASzy™ scans the network, discovers assets, and tests for vulnerabilities

How To: Import Scan Data

CVEasy AI supports 9 scanner formats with automatic format detection:

What happens after import

1. Assets created — every host in the scan becomes an asset in your inventory
2. CVEs linked — vulnerabilities are linked to assets with port and CVSS data
3. Missing CVEs fetched — any CVEs not in the database are fetched from NVD automatically
4. Risk scores calculated — TRIS™ scores computed for each CVE on each asset
5. Attack surface updated — the attack surface view reflects the new data immediately

How To: Run Network Discovery

BASzy's discovery engine finds assets on your network without requiring any scanner software. It performs an 8-phase enumeration:

1. ARP sweep — instantly discovers devices on the local subnet
2. Ping sweep — identifies live hosts across the target range
3. Port scan — checks 47 common ports on each live host
4. Banner grab — reads service banners to identify software versions
5. SSL/TLS analysis — extracts hostnames from certificates
6. DNS resolution — reverse DNS lookup on all discovered IPs
7. mDNS/Bonjour — finds Apple devices and IoT
8. Classification — categorizes each device (server, workstation, router, printer, IoT)

How To: Generate AI Remediation

CVEasy AI generates specific remediation playbooks — not generic "apply the latest patch" advice. Each playbook includes exact commands, verification steps, and rollback procedures.

How To: Run BASzy Attack Campaigns

BASzy includes 10 pre-built attack campaigns that simulate real-world threat scenarios. Each campaign chains multiple techniques exactly like a real attacker.

Available Campaigns

Understanding Results

Each test in a campaign produces one of four outcomes:

• BLOCKED — your security control prevented the attack (this is good)
• DETECTED — the attack succeeded but was caught (acceptable)
• UNDETECTED — the attack succeeded with no detection (fix this)
• SKIPPED — not applicable to your environment

How To: View Your Attack Surface

The Attack Surface view shows your entire environment from an attacker's perspective: which assets are exposed, which CVEs affect them, and how an attacker could chain exploits to reach your critical data.

Key elements:

• Executive narrative — auto-generated text for board presentations
• Risk-scored assets — sorted by actual risk, not just CVE count
• Attack paths — visual paths from entry points to crown jewels
• Chainable assets — assets with critical CVEs on multiple ports (lateral movement risk)

How To: Generate Reports

Go to Reports in the sidebar. CVEasy generates professional PDF reports suitable for:

• Board presentations — executive summary with risk narrative
• Compliance audits — controls mapped to HIPAA, PCI-DSS, SOC 2, etc.
• Technical teams — detailed findings with remediation steps
• Vulnerability trending — how your posture has changed over time

How To: Backup Your Data

Your CVEasy database contains all your vulnerability data, scan history, asset inventory, and configuration. Back it up regularly.

Manual Backup

1. Go to Settings → Backup
2. Click Create Backup
3. The backup is saved to ~/Library/Application Support/CVEasy AI/backups/
4. Click Download to save a copy externally

Restore from Backup

1. Go to Settings → Backup
2. Click Restore next to the backup you want
3. A safety backup of your current data is created automatically
4. Restart CVEasy AI to complete the restore

TRIS™ Scoring — How It Works

TRIS™ (Threat & Remediation Intelligence Score) is a proprietary 7-layer scoring engine that goes far beyond CVSS:

1. CVSS Base Score — technical severity of the vulnerability
2. EPSS Probability — likelihood of exploitation in the next 30 days
3. CISA KEV Status — is this actively exploited in the wild?
4. Threat Actor Targeting — are known APT groups using this CVE?
5. Asset Criticality — how important is the affected asset?
6. Public Exposure — is the asset internet-facing?
7. BASzy Validation — was exploitability proven by attack simulation?

TRIS produces a score from 0-95 and assigns a priority band:

• ACT (75-95) — remediate immediately, actively dangerous
• ATTEND (50-74) — high priority, schedule remediation this sprint
• TRACK (25-49) — monitor, remediate in next cycle
• MONITOR (0-24) — low risk, track for changes

Compliance Mapping

CVEasy maps every CVE to 86 controls across 9 compliance frameworks:

• HIPAA (11 controls)
• PCI-DSS v4.0 (15 controls)
• SOC 2 TSC (9 controls)
• ISO 27001:2022 (11 controls)
• NIST CSF v2.0 (8 controls)
• CIS Controls v8 (12 controls)
• FedRAMP / NIST 800-53 (13 controls)
• GDPR (4 controls)
• CCPA (3 controls)

Supported Scanner Formats

CVEasy accepts exports from all major vulnerability scanners. Upload the file and format is auto-detected. Supported: Nessus, Qualys, Rapid7 InsightVM, OpenVAS/GVM, Nuclei, Burp Suite, OWASP ZAP, Aqua Trivy, and generic CSV (any scanner that exports CSV).

Keyboard Shortcuts

EDR Whitelisting

BASzy performs authorized security testing that may trigger EDR/AV alerts. Whitelist the following before running attack simulations:

/Applications/CVEasy AI.app/Contents/MacOS/cveasy-ai
/Applications/CVEasy AI.app/Contents/MacOS/cveasy-server
/Applications/CVEasy AI.app/Contents/MacOS/llama-server
/Applications/CVEasy AI.app/Contents/MacOS/baszy-server

Detailed instructions for CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, and Sophos are available in our EDR Whitelisting Guide.

Frequently Asked Questions