CVEasy AI documentation

Set up, configure, and run CVEasy AI, the first complete CTEM platform on Apple hardware. Installation, the connect-score-validate-fix loop, every feature, and a full FAQ.

What CVEasy does that a scanner doesn't

Most tools stop at a list of vulnerabilities. CVEasy proves which findings are exploitable, generates the exact fix, and proves the fix held. Jump to any capability below.

Installation and setup

First steps after installation

Once CVEasy AI is running, start with one of these:

Option A: You have existing scan data

If your team runs Nessus, Qualys, Rapid7, or any other vulnerability scanner, import your most recent scan:

1. Click Scan Imports in the sidebar
2. Click Import Scan
3. Upload your scan file (drag & drop or file picker)
4. CVEasy auto-detects the format, creates assets, and links CVEs

Option B: You don't have scan data

No scanner? No problem. BASzy discovers your assets automatically:

1. Click BASzy in the sidebar
2. Click New Scan
3. Enter your network range (e.g., 10.0.0.0/24)
4. BASzy™ scans the network, discovers assets, and tests for vulnerabilities

Connect a scanner or EDR

The Connectors catalog carries 152 out-of-the-box integrations across 16 categories (vuln scanners, EDR, cloud, AppSec & code, identity, controls, network, CMDB, EASM, SIEM, ticketing, patch, and more). Every card is honest about its mode: API pull, file import, push ingest, outbound, or built-in.

CVEasy AI · Connectors

Connectors catalog. 152 integrations, filterable by category and mode. The mitigating-controls panel up top feeds TRIS Layer 10.

The native API connectors pull findings directly from the vendor's API, with full asset identity and no export files. To set one up:

1. Open Connectors under Integrate and pick your vendor (for example Rapid7 InsightVM, Tenable.io, Qualys VMDR, CrowdStrike, SentinelOne, or Microsoft Defender TVM).
2. Paste the API credentials. They are AES-GCM encrypted at rest and scoped to the current workspace.
3. Test verifies the connection, then Pull ingests immediately.
4. Schedule sets auto-sync: every 15 minutes, hourly, every 6 hours, or daily.

Deduplication: findings from every connector and import are matched on IP, hostname, MAC, and agent UUID, so the same exposure reported by three tools becomes one work item. Teams see around a 75% reduction in ticket volume. EDR connectors also carry control telemetry, which feeds TRIS Layer 10.

Push findings over the webhook API

Anything that can POST a file can feed CVEasy. The ingest endpoint accepts 43 file formats with automatic detection, authenticated by per-tenant API keys (generate and manage them under Integrate → API Keys):

Limits: 10 MB or 50,000 findings per request. MSSPs use per-tenant keys to keep client workspaces isolated. CI pipelines commonly push Trivy and SARIF output on every build.

Import scan data

CVEasy AI accepts 13 scanner formats with automatic format detection, and six more tools connect as native API clients (see Connect a Scanner or EDR):

Auto-detection: Just upload the file. CVEasy automatically detects the format. You don't need to specify which scanner produced it.

What happens after import

1. Assets created, every host in the scan becomes an asset in your inventory
2. CVEs linked, vulnerabilities are linked to assets with port and CVSS data
3. Missing CVEs fetched, any CVEs not in the database are fetched from NVD automatically
4. Risk scores calculated. TRIS™ scores computed for each CVE on each asset
5. Attack surface updated, the attack surface view reflects the new data immediately

Run network discovery

CVEasy runs agentless network discovery, so you can build an asset inventory without deploying anything to your hosts and without a separate scanner license. It works as a second source of truth alongside the scanners you already run:

1. Service sweep, an agentless TCP sweep of the authorized range finds live hosts and open services
2. Service and version fingerprinting, reads service banners to identify software and versions
3. Classification, categorizes each device (server, workstation, router, printer, IoT)
4. Consolidation, merges the results with imported scanner exports (43 file imports, 73 native API connectors) and BASzy findings into one deduplicated asset and attack-path graph

Generate AI remediation

CVEasy AI generates specific remediation playbooks, not generic "apply the latest patch" advice. Each playbook includes exact commands, verification steps, and rollback procedures.

Run BASzy attack campaigns

BASzy includes 10 pre-built attack campaigns that simulate real-world threat scenarios. Each campaign chains multiple techniques exactly like a real attacker.

Available campaigns

Understanding results

Each test in a campaign produces one of four outcomes:

• BLOCKED, your security control prevented the attack (this is good)
• DETECTED, the attack succeeded but was caught (acceptable)
• UNDETECTED, the attack succeeded with no detection (fix this)
• SKIPPED, not applicable to your environment

View your attack surface

The Attack Surface view shows your entire environment from an attacker's perspective: which assets are exposed, which CVEs affect them, and how an attacker could chain exploits to reach your critical data.

Key elements:

• Executive narrative, auto-generated text for board presentations
• Risk-scored assets, sorted by actual risk, not raw CVE count
• Attack paths, visual paths from entry points to crown jewels
• Chainable assets, assets with critical CVEs on multiple ports (lateral movement risk)

Work the Fix First board

Fix First (under Remediate) turns the ranked finding list into work orders. Findings are grouped by the fix that closes them, ranked by TRIS, and stamped with an SLA band. Each card shows the affected assets and how many findings one fix closes, with three actions:

1. Push Now dispatches the patch through your connected console: Intune, Automox, Tanium, Jamf Pro, PDQ Connect, or a universal webhook.
2. Schedule queues it into a maintenance window.
3. Ticket creates a mapped ticket in Jira, ServiceNow, GitHub Issues, Linear, or Monday.com.

CVEasy AI · Fix First

Fix First. The prioritized worklist: what to fix first, ranked by real-world risk, with Review, Ticket, and Verify on every card.

Closed loop: every action is audit-logged, and the next sync re-checks the exposure to confirm the fix landed. Notification events (Slack, Teams, Discord, PagerDuty) fire on deploy and on verified remediation.

Generate reports

Go to Reports under Operate in the sidebar. CVEasy generates professional reports in HTML and PDF, suitable for:

• Board presentations, executive summary with risk narrative
• Compliance audits, controls mapped to HIPAA, PCI-DSS, SOC 2, etc.
• Technical teams, detailed findings with remediation steps
• Vulnerability trending, how your posture has changed over time

Connect Claude via MCP

The native MCP server exposes your live instance to Claude Desktop and Claude Code as typed agent tools: CVE lookup, findings search, posture queries, TRIS score breakdowns, report rendering, and work-order creation. The server connects to your local instance, so exposure data stays on your hardware.

Install and configuration instructions live in the open-source repo: github.com/CVEasy/cveasy-mcp. CVEasy is an Anthropic Claude Network Partner.

Install for your client

The server is on npm as cveasy-mcp and needs Node 22 or newer. CVEasy AI must be running; the server only talks to it on 127.0.0.1:3001.

Claude Desktop

Download the extension bundle from the releases page and open it; Claude Desktop installs it and asks for the backend URL. Or add it by hand to claude_desktop_config.json:

{
  "mcpServers": {
    "cveasy": { "command": "npx", "args": ["-y", "cveasy-mcp"] }
  }
}

Claude Code

claude mcp add cveasy -- npx -y cveasy-mcp

Or install the plugin, which adds the server plus two TRIS skills: /plugin marketplace add CVEasy/cveasy-claude-plugin then /plugin install cveasy@cveasy-claude-plugin.

Cursor

Add to .cursor/mcp.json in the project or ~/.cursor/mcp.json globally:

{ "mcpServers": { "cveasy": { "command": "npx", "args": ["-y", "cveasy-mcp"] } } }

OpenAI Codex

Add to ~/.codex/config.toml:

[mcp_servers.cveasy]
command = "npx"
args = ["-y", "cveasy-mcp"]

VS Code (Copilot agent mode)

Add to .vscode/mcp.json:

{ "servers": { "cveasy": { "type": "stdio", "command": "npx", "args": ["-y", "cveasy-mcp"] } } }

Write tools and BASzy scan starts stay off until you set CVEASY_ALLOW_WRITES=1 or CVEASY_ALLOW_SCANS=1 in the server's env. Every call is audit logged.

Back up your data

Your CVEasy database contains all your vulnerability data, scan history, asset inventory, and configuration. Back it up regularly.

Manual backup

1. Go to Settings → Backup
2. Click Create Backup
3. The backup is saved to ~/Library/Application Support/CVEasy AI/backups/
4. Click Download to save a copy externally

Restore from backup

1. Go to Settings → Backup
2. Click Restore next to the backup you want
3. A safety backup of your current data is created automatically
4. Restart CVEasy AI to complete the restore

Backup location: ~/Library/Application Support/CVEasy AI/backups/
Copy this folder to external storage for disaster recovery.

How TRIS™ scoring works

TRIS™ v2 (True Risk Intelligence Score) is a proprietary 12-layer scoring engine that goes far beyond CVSS. Seven foundational and contextual layers plus five novel dimensions no competitor combines:

1. CVSS Base Score, technical severity of the vulnerability
2. EPSS Probability, likelihood of exploitation in the next 30 days
3. CISA KEV Status, is this actively exploited in the wild?
4. Threat Actor Targeting, are known APT groups using this CVE?
5. Asset Criticality, how important is the affected asset?
6. Public Exposure, is the asset internet-facing?
7. BASzy Validation, was exploitability proven by attack simulation?
8. Attack Path Blast Radius, how many assets can this reach via lateral movement?
9. Supply Chain Propagation, how deep does the vulnerable dependency sit in your SBOM?
10. Defense Efficacy, what share of the mapped MITRE ATT&CK techniques do your controls cover?
11. Predictive Trajectory, is exploitation accelerating or decaying right now?
12. Financial Impact, FAIR-based expected monetary loss

TRIS produces a score from 0-100 and assigns a priority band:

• ACT (90-100), remediate immediately, actively dangerous
• ATTEND (75-89), high priority, schedule remediation this sprint
• TRACK (50-74), monitor, remediate in next cycle
• MONITOR (25-49), low risk, track for changes
• INFORMATIONAL (0-24), noise, document and move on

The TRIS Sprint Board (under Remediate in the sidebar) groups every finding into its action band so prioritization is a glance, not a debate. Click any score chip to see the full 12-layer breakdown.

Compliance mapping

CVEasy maps every CVE to 86 controls across 9 compliance frameworks:

• HIPAA (11 controls)
• PCI-DSS v4.0 (15 controls)
• SOC 2 TSC (9 controls)
• ISO 27001:2022 (11 controls)
• NIST CSF v2.0 (8 controls)
• CIS Controls v8 (12 controls)
• FedRAMP / NIST 800-53 (13 controls)
• GDPR (4 controls)
• CCPA (3 controls)

Supported scanner formats

CVEasy accepts 13 file formats with automatic detection: Nessus, Qualys, Rapid7 InsightVM, OpenVAS/GVM, Nuclei, Burp Suite, OWASP ZAP, Aqua Trivy, Wiz, Prowler, Nmap, SARIF, and generic CSV (any scanner that exports CSV). Six of these tools also connect as native API clients for scheduled auto-sync, see Connect a Scanner or EDR.

Keyboard shortcuts

Attack Surface Canvas

The Live Attack Surface Canvas is an interactive network visualization that shows your entire infrastructure in one view. It is a proprietary feature unique to CVEasy AI, no other CTEM platform offers this.

CVEasy AI · Attack Paths

Attack Path Visualization. The graph chains your real findings into the paths an attacker would actually take to reach your crown jewels.

How to access

Navigate to Attack Surface in the sidebar. Click Network Map at the top right to switch from table view to the interactive canvas.

Understanding the canvas

• Nodes represent assets (servers, databases, workstations). Size indicates criticality. Color indicates risk level: red = critical, orange = high, yellow = medium, green = healthy, purple = crown jewel.
• Edges show network connectivity. Solid lines = same subnet. Dashed red lines = lateral movement paths (SSH, SMB, RDP, WinRM).
• Animated red dots trace attack paths from entry points to crown jewels, showing exactly how an attacker would chain techniques to reach your most critical assets.
• Subnet groups are shown as background regions with labels (e.g., 192.168.1.0/24).

Interacting with the canvas

• Click any node to open the detail panel (IP, OS, services, CVEs, attack paths)
• Drag nodes to rearrange the layout
• Scroll to zoom in/out
• Pan by clicking and dragging empty space
• Toggle lateral edges and attack paths using the toolbar buttons
• Reset View returns to the default zoom and position

Node badges

• PUB. Public-facing asset (internet-exposed)
• DC. Domain controller
• DB. Database server
• WEB. Web server
• Red number badge. CVE count on that asset

AutoFuzz engine

AutoFuzz is CVEasy AI's proprietary zero-day discovery engine. Unlike static attack libraries, AutoFuzz takes known payloads and generates novel variants using 37 mutation strategies. When a mutation bypasses a defense that blocked the original payload, that's a zero-day-class discovery unique to your environment.

How it works

1. BASzy fires a known attack payload at a target (e.g., ' OR 1=1--)
2. If the payload is BLOCKED by a WAF/EDR, AutoFuzz activates
3. AutoFuzz generates encoded variants: URL encoding, Unicode escapes, HTML entities, null byte injection, comment injection, case swapping, and more
4. Each variant is tested against the same target
5. If a variant bypasses the defense, it's classified as a zero-day bypass and stored in the Zero-Day Vault

Mutation strategies

AutoFuzz includes 37 strategies organized into categories:

• Encoding: Base64, double Base64, URL, double URL, hex, Unicode, HTML entities, octal, UTF-7
• Case: Case swap, random case mixing
• Whitespace: Null byte injection, zero-width characters, tab replacement, newline injection
• Comments: SQL comment (/**/), HTML comment (<!---->), JS comment injection
• Splitting: SQL CONCAT, JS string concatenation, CHAR() function encoding
• Substitution: Cyrillic homoglyphs, fullwidth Unicode characters
• Context: HTML attribute wrapping, tag wrapping, JS string context, JSON prototype pollution, XML wrapping
• Polyglot: Cross-context XSS payloads
• WAF bypass: Chunked encoding, multipart wrapping

Strategy chaining

AutoFuzz automatically chains strategies (e.g., URL-encode + case-swap + comment-inject) to discover multi-layer bypasses that single-strategy approaches miss.

Remediation proof engine

The Remediation Proof Engine provides auditable evidence that your fixes actually worked. No other security platform offers closed-loop verification like this.

How it works

1. Before: BASzy finds a vulnerability (UNDETECTED) and stores a baseline snapshot, the exact attack, payload, and evidence
2. Fix: You apply the remediation (CVEasy AI generates the exact commands)
3. After: Click "Verify Fix". BASzy re-runs the same attack with the same payload
4. Proof: The engine compares before and after: UNDETECTED -> BLOCKED = VERIFIED

Proof reports

Each verification generates an auditable proof containing:

• Before snapshot: attack payload, outcome (UNDETECTED), timestamp, evidence
• After snapshot: same payload, new outcome (BLOCKED), timestamp, evidence
• Remediation applied: the exact commands that were run
• Risk reduction classification: critical_to_blocked, detected_to_blocked, etc.

Dashboard

The Remediation Proof Dashboard shows total proofs generated, verification success rate, breakdowns by asset and MITRE technique, and a list of pending baselines awaiting verification.

Detection rule export

When BASzy proves an attack bypasses your defenses, CVEasy AI automatically generates detection rules to catch it. Rules are generated in 6 formats:

How to export

After a BASzy campaign completes, go to the findings page. Each UNDETECTED finding has an "Export Detection Rules" button that generates rules in all 6 formats. Copy and paste directly into your SIEM.

SIEM integration

CVEasy AI can push findings, alerts, and detection rules to your existing security tools:

Configuration

Go to Settings -> Integrations to configure your SIEM connections. Each integration requires:

• Splunk: HEC URL and token
• Sentinel: Workspace ID and shared key
• Elastic: Elasticsearch URL and API key
• ServiceNow: Instance name, username, password
• Slack/Teams: Webhook URL
• Syslog: Host, port, protocol (UDP/TCP)

Posture scoring

CVEasy AI calculates a composite security posture score (0-100) from your BASzy results, weighted across 6 categories:

Grading

A = 90+, B = 80-89, C = 70-79, D = 60-69, F = below 60. Industry benchmarks are included for comparison (healthcare avg: 58, financial: 72, technology: 68, government: 55).

Ransomware readiness assessment

A dedicated assessment that tests your defenses against each phase of the ransomware kill chain:

1. Initial Access Prevention, phishing detection, exposed service patching
2. Execution Controls, script blocking, macro restrictions, application whitelisting
3. Credential Protection. LSASS protection, MFA enforcement, credential rotation
4. Lateral Movement Controls, network segmentation, admin share restrictions, SMB controls
5. Discovery Detection, network scan alerting, AD enumeration detection
6. Data Protection. DLP policies, staging detection, encryption at rest
7. Exfiltration Prevention. DNS filtering, outbound monitoring, proxy enforcement
8. Encryption Defense, ransomware behavior detection, file integrity monitoring
9. Recovery Capability, backup integrity, offline backups, recovery time objectives
10. C2 Detection, beacon detection, DNS tunnel identification, proxy enforcement

Each phase is scored and produces specific recommendations. Overall readiness levels: READY (80+), PARTIAL (60-79), AT RISK (40-59), CRITICAL (below 40).

System requirements

What's included in the DMG

• CVEasy AI application (Tauri desktop shell)
• Backend server (cveasy-server)
• BASzy attack engine (baszy-server)
• AI inference engine (llama-server, zero external dependencies)
• AI model (4.4 GB GGUF, optimized for Apple Silicon Metal GPU)
• CVE database (361,000+ CVEs pre-loaded)
• Attack payload database (158,271 validated payloads across 120 categories)

No Homebrew, Docker, Python, or cloud accounts needed. Everything runs from the app bundle.

Troubleshooting

EDR whitelisting

BASzy performs authorized security testing that may trigger EDR/AV alerts. Whitelist the following before running attack simulations:

/Applications/CVEasy AI.app/Contents/MacOS/cveasy-ai
/Applications/CVEasy AI.app/Contents/MacOS/cveasy-server
/Applications/CVEasy AI.app/Contents/MacOS/llama-server
/Applications/CVEasy AI.app/Contents/MacOS/baszy-server

For platform-specific steps covering CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, and Sophos, contact support@cveasyai.com.

Frequently asked questions