CVEasy AI Documentation

Everything you need to set up, configure, and get the most out of CVEasy AI, the first complete CTEM platform on Apple hardware.

What makes CVEasy different

Most tools hand you a list of vulnerabilities and stop. CVEasy proves which findings are actually exploitable, generates the exact fix, and proves the fix held. These capabilities do not exist, combined, in any other platform.

Installation & Setup

CVEasy AI · Setup Wizard

First launch. The setup wizard verifies the AI engine, model, and database, then walks you through your organization profile.

First Steps After Installation

Once CVEasy AI is running, here's what to do first:

Option A: You have existing scan data

If your team runs Nessus, Qualys, Rapid7, or any other vulnerability scanner, import your most recent scan:

1. Click Scan Imports in the sidebar
2. Click Import Scan
3. Upload your scan file (drag & drop or file picker)
4. CVEasy auto-detects the format, creates assets, and links CVEs

CVEasy AI · Scan Imports

Scan Imports. Drag a scanner export onto the drop zone. CVEasy auto-detects the format across 13 supported tools.

Option B: You don't have scan data

No scanner? No problem. BASzy discovers your assets automatically:

1. Click BASzy in the sidebar
2. Click New Scan
3. Enter your network range (e.g., 10.0.0.0/24)
4. BASzy™ scans the network, discovers assets, and tests for vulnerabilities

CVEasy AI · BAS Scanner

BAS Scanner. Pick a target, run an 8-phase agentless discovery, and BASzy validates exploitability with real attack techniques.

How To: Import Scan Data

CVEasy AI supports 9 scanner formats with automatic format detection:

What happens after import

1. Assets created, every host in the scan becomes an asset in your inventory
2. CVEs linked, vulnerabilities are linked to assets with port and CVSS data
3. Missing CVEs fetched, any CVEs not in the database are fetched from NVD automatically
4. Risk scores calculated. TRIS™ scores computed for each CVE on each asset
5. Attack surface updated, the attack surface view reflects the new data immediately

How To: Run Network Discovery

BASzy's discovery engine finds assets on your network without requiring any scanner software. It performs an 8-phase enumeration:

1. ARP sweep, instantly discovers devices on the local subnet
2. Ping sweep, identifies live hosts across the target range
3. Port scan, checks 47 common ports on each live host
4. Banner grab, reads service banners to identify software versions
5. SSL/TLS analysis, extracts hostnames from certificates
6. DNS resolution, reverse DNS lookup on all discovered IPs
7. mDNS/Bonjour, finds Apple devices and IoT
8. Classification, categorizes each device (server, workstation, router, printer, IoT)

How To: Generate AI Remediation

CVEasy AI generates specific remediation playbooks, not generic "apply the latest patch" advice. Each playbook includes exact commands, verification steps, and rollback procedures.

CVEasy AI · CVE Detail

CVE detail. Remediation generates from the CVE detail page, alongside EPSS, CISA KEV status, attacker pressure, and compliance impact.

CVEasy AI · Solutions

Solutions. CVEasy groups CVEs by root cause so one fix closes many. The leverage column shows how many CVEs each action retires.

How To: Run BASzy Attack Campaigns

BASzy includes 10 pre-built attack campaigns that simulate real-world threat scenarios. Each campaign chains multiple techniques exactly like a real attacker.

Available Campaigns

CVEasy AI · APT Campaigns

Threat-actor campaigns. Ten pre-built campaigns chain real techniques the way a named adversary would, then score how your controls hold up.

CVEasy AI · Defense Map

Defense Map. Every BAS technique mapped to MITRE ATT&CK, so you see which tactics your controls cover and which they miss.

Understanding Results

Each test in a campaign produces one of four outcomes:

• BLOCKED, your security control prevented the attack (this is good)
• DETECTED, the attack succeeded but was caught (acceptable)
• UNDETECTED, the attack succeeded with no detection (fix this)
• SKIPPED, not applicable to your environment

How To: View Your Attack Surface

The Attack Surface view shows your entire environment from an attacker's perspective: which assets are exposed, which CVEs affect them, and how an attacker could chain exploits to reach your critical data.

CVEasy AI · Attack Surface

Attack Surface. Your environment from an attacker's point of view, with risk-scored assets and chainable attack paths.

Key elements:

• Executive narrative, auto-generated text for board presentations
• Risk-scored assets, sorted by actual risk, not just CVE count
• Attack paths, visual paths from entry points to crown jewels
• Chainable assets, assets with critical CVEs on multiple ports (lateral movement risk)

How To: Generate Reports

Go to Reports under Operate in the sidebar. CVEasy generates professional reports in HTML and PDF, suitable for:

• Board presentations, executive summary with risk narrative
• Compliance audits, controls mapped to HIPAA, PCI-DSS, SOC 2, etc.
• Technical teams, detailed findings with remediation steps
• Vulnerability trending, how your posture has changed over time

CVEasy AI · Report Generator

Report Generator. Pick the audience and CVEasy builds the report. Executive, technical, compliance, and board formats in one click.

How To: Backup Your Data

Your CVEasy database contains all your vulnerability data, scan history, asset inventory, and configuration. Back it up regularly.

Manual Backup

1. Go to Settings → Backup
2. Click Create Backup
3. The backup is saved to ~/Library/Application Support/CVEasy AI/backups/
4. Click Download to save a copy externally

Restore from Backup

1. Go to Settings → Backup
2. Click Restore next to the backup you want
3. A safety backup of your current data is created automatically
4. Restart CVEasy AI to complete the restore

TRIS™ Scoring. How It Works

TRIS™ v2 (True Risk Intelligence Score) is a proprietary 12-layer scoring engine that goes far beyond CVSS. Seven foundational and contextual layers plus five novel dimensions no competitor combines:

1. CVSS Base Score, technical severity of the vulnerability
2. EPSS Probability, likelihood of exploitation in the next 30 days
3. CISA KEV Status, is this actively exploited in the wild?
4. Threat Actor Targeting, are known APT groups using this CVE?
5. Asset Criticality, how important is the affected asset?
6. Public Exposure, is the asset internet-facing?
7. BASzy Validation, was exploitability proven by attack simulation?
8. Attack Path Blast Radius, how many assets can this reach via lateral movement?
9. Supply Chain Propagation, how deep does the vulnerable dependency sit in your SBOM?
10. Defense Efficacy, what share of the mapped MITRE ATT&CK techniques do your controls cover?
11. Predictive Trajectory, is exploitation accelerating or decaying right now?
12. Financial Impact, FAIR-based expected monetary loss

TRIS produces a score from 0-100 and assigns a priority band:

• ACT (90-100), remediate immediately, actively dangerous
• ATTEND (75-89), high priority, schedule remediation this sprint
• TRACK (50-74), monitor, remediate in next cycle
• MONITOR (25-49), low risk, track for changes
• INFORMATIONAL (0-24), noise, document and move on

The TRIS Sprint Board (under Remediate in the sidebar) groups every finding into its action band so prioritization is a glance, not a debate. Click any score chip to see the full 12-layer breakdown.

CVEasy AI · TRIS Sprint Board

TRIS Sprint Board. ACT means patch within 72 hours, ATTEND within two weeks, TRACK this quarter.

Compliance Mapping

CVEasy maps every CVE to 86 controls across 9 compliance frameworks:

• HIPAA (11 controls)
• PCI-DSS v4.0 (15 controls)
• SOC 2 TSC (9 controls)
• ISO 27001:2022 (11 controls)
• NIST CSF v2.0 (8 controls)
• CIS Controls v8 (12 controls)
• FedRAMP / NIST 800-53 (13 controls)
• GDPR (4 controls)
• CCPA (3 controls)

CVEasy AI · Policy Compliance

Policy Compliance. Track control status by framework, with a register you can filter by status, priority, and audience.

Supported Scanner Formats

CVEasy accepts exports from all major vulnerability scanners. Upload the file and format is auto-detected. Supported: Nessus, Qualys, Rapid7 InsightVM, OpenVAS/GVM, Nuclei, Burp Suite, OWASP ZAP, Aqua Trivy, and generic CSV (any scanner that exports CSV).

Keyboard Shortcuts

Attack Surface Canvas

The Live Attack Surface Canvas is an interactive network visualization that shows your entire infrastructure in one view. It is a proprietary feature unique to CVEasy AI, no other CTEM platform offers this.

CVEasy AI · Attack Paths

Attack Path Visualization. The graph chains your real findings into the paths an attacker would actually take to reach your crown jewels.

How to Access

Navigate to Attack Surface in the sidebar. Click Network Map at the top right to switch from table view to the interactive canvas.

Understanding the Canvas

• Nodes represent assets (servers, databases, workstations). Size indicates criticality. Color indicates risk level: red = critical, orange = high, yellow = medium, green = healthy, purple = crown jewel.
• Edges show network connectivity. Solid lines = same subnet. Dashed red lines = lateral movement paths (SSH, SMB, RDP, WinRM).
• Animated red dots trace attack paths from entry points to crown jewels, showing exactly how an attacker would chain techniques to reach your most critical assets.
• Subnet groups are shown as background regions with labels (e.g., 192.168.1.0/24).

Interacting with the Canvas

• Click any node to open the detail panel (IP, OS, services, CVEs, attack paths)
• Drag nodes to rearrange the layout
• Scroll to zoom in/out
• Pan by clicking and dragging empty space
• Toggle lateral edges and attack paths using the toolbar buttons
• Reset View returns to the default zoom and position

Node Badges

• PUB. Public-facing asset (internet-exposed)
• DC. Domain controller
• DB. Database server
• WEB. Web server
• Red number badge. CVE count on that asset

AutoFuzz Engine

AutoFuzz is CVEasy AI's proprietary zero-day discovery engine. Unlike static attack libraries, AutoFuzz takes known payloads and generates novel variants using 37 mutation strategies. When a mutation bypasses a defense that blocked the original payload, that's a zero-day-class discovery unique to your environment.

CVEasy AI · Web Fuzzer

Web Fuzzer (AutoFuzz). Grammar-aware mutation fuzzing with differential mode finds smuggling-class zero-days a static payload library would never catch.

How It Works

1. BASzy fires a known attack payload at a target (e.g., ' OR 1=1--)
2. If the payload is BLOCKED by a WAF/EDR, AutoFuzz activates
3. AutoFuzz generates encoded variants: URL encoding, Unicode escapes, HTML entities, null byte injection, comment injection, case swapping, and more
4. Each variant is tested against the same target
5. If a variant bypasses the defense, it's classified as a zero-day bypass and stored in the Zero-Day Vault

Mutation Strategies

AutoFuzz includes 37 strategies organized into categories:

• Encoding: Base64, double Base64, URL, double URL, hex, Unicode, HTML entities, octal, UTF-7
• Case: Case swap, random case mixing
• Whitespace: Null byte injection, zero-width characters, tab replacement, newline injection
• Comments: SQL comment (/**/), HTML comment (<!---->), JS comment injection
• Splitting: SQL CONCAT, JS string concatenation, CHAR() function encoding
• Substitution: Cyrillic homoglyphs, fullwidth Unicode characters
• Context: HTML attribute wrapping, tag wrapping, JS string context, JSON prototype pollution, XML wrapping
• Polyglot: Cross-context XSS payloads
• WAF bypass: Chunked encoding, multipart wrapping

Strategy Chaining

AutoFuzz automatically chains strategies (e.g., URL-encode + case-swap + comment-inject) to discover multi-layer bypasses that single-strategy approaches miss.

Remediation Proof Engine

The Remediation Proof Engine provides auditable evidence that your fixes actually worked. No other security platform offers closed-loop verification like this.

CVEasy AI · Proof-of-Fix

Proof-of-Fix Ledger. Every closed CVE is sealed with an HMAC-signed attestation an auditor can verify offline. No CA, no network.

How It Works

1. Before: BASzy finds a vulnerability (UNDETECTED) and stores a baseline snapshot, the exact attack, payload, and evidence
2. Fix: You apply the remediation (CVEasy AI generates the exact commands)
3. After: Click "Verify Fix". BASzy re-runs the same attack with the same payload
4. Proof: The engine compares before and after: UNDETECTED -> BLOCKED = VERIFIED

Proof Reports

Each verification generates an auditable proof containing:

• Before snapshot: attack payload, outcome (UNDETECTED), timestamp, evidence
• After snapshot: same payload, new outcome (BLOCKED), timestamp, evidence
• Remediation applied: the exact commands that were run
• Risk reduction classification: critical_to_blocked, detected_to_blocked, etc.

Dashboard

The Remediation Proof Dashboard shows total proofs generated, verification success rate, breakdowns by asset and MITRE technique, and a list of pending baselines awaiting verification.

Detection Rule Export

When BASzy proves an attack bypasses your defenses, CVEasy AI automatically generates detection rules to catch it. Rules are generated in 6 formats:

CVEasy AI · Posture Delta

Control Posture Delta. See what your controls blocked, detected, or missed across every BAS finding, then export a detection rule for each gap in one click.

How to Export

After a BASzy campaign completes, go to the findings page. Each UNDETECTED finding has an "Export Detection Rules" button that generates rules in all 6 formats. Copy and paste directly into your SIEM.

SIEM Integration

CVEasy AI can push findings, alerts, and detection rules to your existing security tools:

Configuration

Go to Settings -> Integrations to configure your SIEM connections. Each integration requires:

• Splunk: HEC URL and token
• Sentinel: Workspace ID and shared key
• Elastic: Elasticsearch URL and API key
• ServiceNow: Instance name, username, password
• Slack/Teams: Webhook URL
• Syslog: Host, port, protocol (UDP/TCP)

Posture Scoring

CVEasy AI calculates a composite security posture score (0-100) from your BASzy results, weighted across 6 categories:

Grading

A = 90+, B = 80-89, C = 70-79, D = 60-69, F = below 60. Industry benchmarks are included for comparison (healthcare avg: 58, financial: 72, technology: 68, government: 55).

Ransomware Readiness Assessment

A dedicated assessment that tests your defenses against each phase of the ransomware kill chain:

1. Initial Access Prevention, phishing detection, exposed service patching
2. Execution Controls, script blocking, macro restrictions, application whitelisting
3. Credential Protection. LSASS protection, MFA enforcement, credential rotation
4. Lateral Movement Controls, network segmentation, admin share restrictions, SMB controls
5. Discovery Detection, network scan alerting, AD enumeration detection
6. Data Protection. DLP policies, staging detection, encryption at rest
7. Exfiltration Prevention. DNS filtering, outbound monitoring, proxy enforcement
8. Encryption Defense, ransomware behavior detection, file integrity monitoring
9. Recovery Capability, backup integrity, offline backups, recovery time objectives
10. C2 Detection, beacon detection, DNS tunnel identification, proxy enforcement

Each phase is scored and produces specific recommendations. Overall readiness levels: READY (80+), PARTIAL (60-79), AT RISK (40-59), CRITICAL (below 40).

System Requirements

What's Included in the DMG

• CVEasy AI application (Tauri desktop shell)
• Backend server (cveasy-server)
• BASzy attack engine (baszy-server)
• AI inference engine (llama-server, zero external dependencies)
• AI model (4.4 GB GGUF, optimized for Apple Silicon Metal GPU)
• CVE database (337,124 CVEs pre-loaded)
• Attack payload database (12,868 validated payloads across 40 categories)

No Homebrew, Docker, Python, or cloud accounts needed. Everything runs from the app bundle.

Troubleshooting

EDR Whitelisting

BASzy performs authorized security testing that may trigger EDR/AV alerts. Whitelist the following before running attack simulations:

/Applications/CVEasy AI.app/Contents/MacOS/cveasy-ai
/Applications/CVEasy AI.app/Contents/MacOS/cveasy-server
/Applications/CVEasy AI.app/Contents/MacOS/llama-server
/Applications/CVEasy AI.app/Contents/MacOS/baszy-server

For platform-specific steps covering CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, and Sophos, contact support@cveasyai.com.

Frequently Asked Questions