CVEasy AI Documentation

Everything you need to set up, configure, and get the most out of CVEasy AI, the first complete CTEM platform.

Installation & Setup

First Steps After Installation

Once CVEasy AI is running, here's what to do first:

Option A: You have existing scan data

If your team runs Nessus, Qualys, Rapid7, or any other vulnerability scanner, import your most recent scan:

1. Click Scan Imports in the sidebar
2. Click Import Scan
3. Upload your scan file (drag & drop or file picker)
4. CVEasy auto-detects the format, creates assets, and links CVEs

Option B: You don't have scan data

No scanner? No problem. BASzy discovers your assets automatically:

1. Click BASzy in the sidebar
2. Click New Scan
3. Enter your network range (e.g., 10.0.0.0/24)
4. BASzy™ scans the network, discovers assets, and tests for vulnerabilities

How To: Import Scan Data

CVEasy AI supports 9 scanner formats with automatic format detection:

What happens after import

1. Assets created, every host in the scan becomes an asset in your inventory
2. CVEs linked, vulnerabilities are linked to assets with port and CVSS data
3. Missing CVEs fetched, any CVEs not in the database are fetched from NVD automatically
4. Risk scores calculated. TRIS™ scores computed for each CVE on each asset
5. Attack surface updated, the attack surface view reflects the new data immediately

How To: Run Network Discovery

BASzy's discovery engine finds assets on your network without requiring any scanner software. It performs an 8-phase enumeration:

1. ARP sweep, instantly discovers devices on the local subnet
2. Ping sweep, identifies live hosts across the target range
3. Port scan, checks 47 common ports on each live host
4. Banner grab, reads service banners to identify software versions
5. SSL/TLS analysis, extracts hostnames from certificates
6. DNS resolution, reverse DNS lookup on all discovered IPs
7. mDNS/Bonjour, finds Apple devices and IoT
8. Classification, categorizes each device (server, workstation, router, printer, IoT)

How To: Generate AI Remediation

CVEasy AI generates specific remediation playbooks, not generic "apply the latest patch" advice. Each playbook includes exact commands, verification steps, and rollback procedures.

How To: Run BASzy Attack Campaigns

BASzy includes 10 pre-built attack campaigns that simulate real-world threat scenarios. Each campaign chains multiple techniques exactly like a real attacker.

Available Campaigns

Understanding Results

Each test in a campaign produces one of four outcomes:

• BLOCKED, your security control prevented the attack (this is good)
• DETECTED, the attack succeeded but was caught (acceptable)
• UNDETECTED, the attack succeeded with no detection (fix this)
• SKIPPED, not applicable to your environment

How To: View Your Attack Surface

The Attack Surface view shows your entire environment from an attacker's perspective: which assets are exposed, which CVEs affect them, and how an attacker could chain exploits to reach your critical data.

Key elements:

• Executive narrative, auto-generated text for board presentations
• Risk-scored assets, sorted by actual risk, not just CVE count
• Attack paths, visual paths from entry points to crown jewels
• Chainable assets, assets with critical CVEs on multiple ports (lateral movement risk)

How To: Generate Reports

Go to Reports in the sidebar. CVEasy generates professional PDF reports suitable for:

• Board presentations, executive summary with risk narrative
• Compliance audits, controls mapped to HIPAA, PCI-DSS, SOC 2, etc.
• Technical teams, detailed findings with remediation steps
• Vulnerability trending, how your posture has changed over time

How To: Backup Your Data

Your CVEasy database contains all your vulnerability data, scan history, asset inventory, and configuration. Back it up regularly.

Manual Backup

1. Go to Settings → Backup
2. Click Create Backup
3. The backup is saved to ~/Library/Application Support/CVEasy AI/backups/
4. Click Download to save a copy externally

Restore from Backup

1. Go to Settings → Backup
2. Click Restore next to the backup you want
3. A safety backup of your current data is created automatically
4. Restart CVEasy AI to complete the restore

TRIS™ Scoring. How It Works

TRIS™ (TrueRisk Intelligence Score) is a proprietary 7-layer scoring engine that goes far beyond CVSS:

1. CVSS Base Score, technical severity of the vulnerability
2. EPSS Probability, likelihood of exploitation in the next 30 days
3. CISA KEV Status, is this actively exploited in the wild?
4. Threat Actor Targeting, are known APT groups using this CVE?
5. Asset Criticality, how important is the affected asset?
6. Public Exposure, is the asset internet-facing?
7. BASzy Validation, was exploitability proven by attack simulation?

TRIS produces a score from 0-95 and assigns a priority band:

• ACT (75-95), remediate immediately, actively dangerous
• ATTEND (50-74), high priority, schedule remediation this sprint
• TRACK (25-49), monitor, remediate in next cycle
• MONITOR (0-24), low risk, track for changes

Compliance Mapping

CVEasy maps every CVE to 86 controls across 9 compliance frameworks:

• HIPAA (11 controls)
• PCI-DSS v4.0 (15 controls)
• SOC 2 TSC (9 controls)
• ISO 27001:2022 (11 controls)
• NIST CSF v2.0 (8 controls)
• CIS Controls v8 (12 controls)
• FedRAMP / NIST 800-53 (13 controls)
• GDPR (4 controls)
• CCPA (3 controls)

Supported Scanner Formats

CVEasy accepts exports from all major vulnerability scanners. Upload the file and format is auto-detected. Supported: Nessus, Qualys, Rapid7 InsightVM, OpenVAS/GVM, Nuclei, Burp Suite, OWASP ZAP, Aqua Trivy, and generic CSV (any scanner that exports CSV).

Keyboard Shortcuts

Attack Surface Canvas

The Live Attack Surface Canvas is an interactive network visualization that shows your entire infrastructure in one view. It is a proprietary feature unique to CVEasy AI, no other CTEM platform offers this.

How to Access

Navigate to Attack Surface in the sidebar. Click Network Map at the top right to switch from table view to the interactive canvas.

Understanding the Canvas

• Nodes represent assets (servers, databases, workstations). Size indicates criticality. Color indicates risk level: red = critical, orange = high, yellow = medium, green = healthy, purple = crown jewel.
• Edges show network connectivity. Solid lines = same subnet. Dashed red lines = lateral movement paths (SSH, SMB, RDP, WinRM).
• Animated red dots trace attack paths from entry points to crown jewels, showing exactly how an attacker would chain techniques to reach your most critical assets.
• Subnet groups are shown as background regions with labels (e.g., 192.168.1.0/24).

Interacting with the Canvas

• Click any node to open the detail panel (IP, OS, services, CVEs, attack paths)
• Drag nodes to rearrange the layout
• Scroll to zoom in/out
• Pan by clicking and dragging empty space
• Toggle lateral edges and attack paths using the toolbar buttons
• Reset View returns to the default zoom and position

Node Badges

• PUB. Public-facing asset (internet-exposed)
• DC. Domain controller
• DB. Database server
• WEB. Web server
• Red number badge. CVE count on that asset

AutoFuzz Engine

AutoFuzz is CVEasy AI's proprietary zero-day discovery engine. Unlike static attack libraries, AutoFuzz takes known payloads and generates novel variants using 37 mutation strategies. When a mutation bypasses a defense that blocked the original payload, that's a zero-day-class discovery unique to your environment.

How It Works

1. BASzy fires a known attack payload at a target (e.g., ' OR 1=1--)
2. If the payload is BLOCKED by a WAF/EDR, AutoFuzz activates
3. AutoFuzz generates encoded variants: URL encoding, Unicode escapes, HTML entities, null byte injection, comment injection, case swapping, and more
4. Each variant is tested against the same target
5. If a variant bypasses the defense, it's classified as a zero-day bypass and stored in the Zero-Day Vault

Mutation Strategies

AutoFuzz includes 37 strategies organized into categories:

• Encoding: Base64, double Base64, URL, double URL, hex, Unicode, HTML entities, octal, UTF-7
• Case: Case swap, random case mixing
• Whitespace: Null byte injection, zero-width characters, tab replacement, newline injection
• Comments: SQL comment (/**/), HTML comment (<!---->), JS comment injection
• Splitting: SQL CONCAT, JS string concatenation, CHAR() function encoding
• Substitution: Cyrillic homoglyphs, fullwidth Unicode characters
• Context: HTML attribute wrapping, tag wrapping, JS string context, JSON prototype pollution, XML wrapping
• Polyglot: Cross-context XSS payloads
• WAF bypass: Chunked encoding, multipart wrapping

Strategy Chaining

AutoFuzz automatically chains strategies (e.g., URL-encode + case-swap + comment-inject) to discover multi-layer bypasses that single-strategy approaches miss.

Remediation Proof Engine

The Remediation Proof Engine provides auditable evidence that your fixes actually worked. No other security platform offers closed-loop verification like this.

How It Works

1. Before: BASzy finds a vulnerability (UNDETECTED) and stores a baseline snapshot, the exact attack, payload, and evidence
2. Fix: You apply the remediation (CVEasy AI generates the exact commands)
3. After: Click "Verify Fix". BASzy re-runs the same attack with the same payload
4. Proof: The engine compares before and after: UNDETECTED -> BLOCKED = VERIFIED

Proof Reports

Each verification generates an auditable proof containing:

• Before snapshot: attack payload, outcome (UNDETECTED), timestamp, evidence
• After snapshot: same payload, new outcome (BLOCKED), timestamp, evidence
• Remediation applied: the exact commands that were run
• Risk reduction classification: critical_to_blocked, detected_to_blocked, etc.

Dashboard

The Remediation Proof Dashboard shows total proofs generated, verification success rate, breakdowns by asset and MITRE technique, and a list of pending baselines awaiting verification.

Detection Rule Export

When BASzy proves an attack bypasses your defenses, CVEasy AI automatically generates detection rules to catch it. Rules are generated in 6 formats:

How to Export

After a BASzy campaign completes, go to the findings page. Each UNDETECTED finding has an "Export Detection Rules" button that generates rules in all 6 formats. Copy and paste directly into your SIEM.

SIEM Integration

CVEasy AI can push findings, alerts, and detection rules to your existing security tools:

Configuration

Go to Settings -> Integrations to configure your SIEM connections. Each integration requires:

• Splunk: HEC URL and token
• Sentinel: Workspace ID and shared key
• Elastic: Elasticsearch URL and API key
• ServiceNow: Instance name, username, password
• Slack/Teams: Webhook URL
• Syslog: Host, port, protocol (UDP/TCP)

Posture Scoring

CVEasy AI calculates a composite security posture score (0-100) from your BASzy results, weighted across 6 categories:

Grading

A = 90+, B = 80-89, C = 70-79, D = 60-69, F = below 60. Industry benchmarks are included for comparison (healthcare avg: 58, financial: 72, technology: 68, government: 55).

Ransomware Readiness Assessment

A dedicated assessment that tests your defenses against each phase of the ransomware kill chain:

1. Initial Access Prevention, phishing detection, exposed service patching
2. Execution Controls, script blocking, macro restrictions, application whitelisting
3. Credential Protection. LSASS protection, MFA enforcement, credential rotation
4. Lateral Movement Controls, network segmentation, admin share restrictions, SMB controls
5. Discovery Detection, network scan alerting, AD enumeration detection
6. Data Protection. DLP policies, staging detection, encryption at rest
7. Exfiltration Prevention. DNS filtering, outbound monitoring, proxy enforcement
8. Encryption Defense, ransomware behavior detection, file integrity monitoring
9. Recovery Capability, backup integrity, offline backups, recovery time objectives
10. C2 Detection, beacon detection, DNS tunnel identification, proxy enforcement

Each phase is scored and produces specific recommendations. Overall readiness levels: READY (80+), PARTIAL (60-79), AT RISK (40-59), CRITICAL (below 40).

System Requirements

What's Included in the DMG

• CVEasy AI application (Tauri desktop shell)
• Backend server (cveasy-server)
• BASzy attack engine (baszy-server)
• AI inference engine (llama-server, zero external dependencies)
• AI model (4.4 GB GGUF, optimized for Apple Silicon Metal GPU)
• CVE database (328,256 CVEs pre-loaded)
• Attack payload database (12,868 validated payloads across 40 categories)

No Homebrew, Docker, Python, or cloud accounts needed. Everything runs from the app bundle.

Troubleshooting

EDR Whitelisting

BASzy performs authorized security testing that may trigger EDR/AV alerts. Whitelist the following before running attack simulations:

/Applications/CVEasy AI.app/Contents/MacOS/cveasy-ai
/Applications/CVEasy AI.app/Contents/MacOS/cveasy-server
/Applications/CVEasy AI.app/Contents/MacOS/llama-server
/Applications/CVEasy AI.app/Contents/MacOS/baszy-server

Detailed instructions for CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, and Sophos are available in our EDR Whitelisting Guide.

Frequently Asked Questions