The questions evaluators ask, answered in writing

CVEasy AI is a local-first Continuous Threat Exposure Management (CTEM) platform that combines vulnerability management, AI-powered remediation guidance, and attack simulation in a single application. It runs entirely on your hardware with zero cloud dependency.

Three core capabilities:

• CVEasy AI Engine. Local AI that generates remediation guidance using on-device models
• TRIS v2 Scoring. Proprietary 12-layer risk prioritization (Patent Pending) including attack-path, supply-chain, defense efficacy, and FAIR financial impact
• BASzy AI. Built-in breach and attack simulation with 158,271 payloads across 120 categories, mapped to MITRE ATT&CK

Security teams that need enterprise-grade vulnerability management without the overhead of legacy platforms. Common buyers:

• Security teams at mid-market and enterprise organizations
• MSSPs and MDR providers managing vulnerability programs for multiple clients
• Regulated industries (finance, healthcare, government, defense) that require air-gapped or on-premises deployment
• OT/ICS environments where cloud-connected tools are not permitted

TRIS v2 (True Risk Intelligence Score) is CVEasy AI's proprietary 12-layer contextual risk scoring system. CVSS measures theoretical severity; TRIS weighs twelve real-world signals, seven foundational and contextual layers plus five novel dimensions no competitor combines:

• CVSS base score
• EPSS exploitation probability
• CISA KEV catalog status
• Threat actor targeting
• Asset criticality
• Public exposure topology
• BASzy exploit validation
• Attack-path blast radius
• Supply-chain dependency propagation
• Defense efficacy (MITRE ATT&CK coverage)
• Predictive threat trajectory
• FAIR-based financial impact

The output is an actionable SLA band: ACT (fix immediately), ATTEND (fix within SLA), TRACK (monitor and schedule), MONITOR (watch for trajectory change), or INFORMATIONAL (document and move on). Your team works on what actually matters, not what has the highest CVSS number.

BASzy AI is CVEasy AI's built-in Breach and Attack Simulation engine: 158,271 attack payloads across 120 categories mapped to the MITRE ATT&CK framework, with 6 real APT campaign simulations (Patent Pending). It validates whether your vulnerabilities are actually exploitable before you burn remediation cycles.

BASzy runs entirely locally on your hardware. No external BAS vendor required, no data leaves your network, and no agents need to be installed on target systems. It supports attack chain simulation, agentless collection, and generates interactive HTML reports with a visual attack map.

CVEasy AI ships with a local database of 361,000+ CVEs sourced from the National Vulnerability Database (NVD), complete with CVSS scores, EPSS probabilities, CISA KEV status, and exploit references. Connected installs pull new CVEs from NVD daily, so the catalog keeps climbing on its own. Air-gapped sites take the same updates as snapshot files over removable media.

CVEasy AI is designed to run on modest hardware:

• Operating system: macOS on Apple Silicon
• RAM: 16GB minimum
• Storage: SQLite-based, minimal disk footprint
• Network: None required (fully air-gap capable)

There is no database server to install, no Redis, no Elasticsearch, and no containers. One file is your entire database. Back it up with cp. Migrate it with a USB drive.

The CVEasy AI Engine runs large language models directly on your hardware using local inference. No API keys are required for core AI functionality. The engine generates remediation guidance that includes:

• Step-by-step fix instructions tailored to your environment
• Rollback procedures in case patches cause issues
• Verification commands to confirm the fix worked
• Compensating controls when patching is not immediately possible

Your vulnerability context never touches an external API by default. The local CVEasy AI Engine handles everything on-device, and teams that want agent workflows can connect Claude through the native MCP server, which talks to your local instance rather than shipping data out.

CVEasy generates the fix, then orchestrates its deployment through the patch and MDM consoles your team already runs. CVEasy does not push patches to endpoints itself. Supported connectors:

• Microsoft Intune
• Automox
• Tanium
• Jamf Pro
• PDQ Connect
• Universal webhook. Fallback for any other console

Dispatch is fail-closed with AES-GCM-encrypted credentials, and every deployment is closed-loop verified by re-scanning the affected asset. This is how CVEasy closes the CTEM Mobilize loop without ever touching your endpoints directly.

Yes. CVEasy AI exposes a full REST API for programmatic access to all platform capabilities, including vulnerability data, TRIS scores, scan imports, remediation guidance, reporting, and BASzy simulation triggers. The API enables integration with your existing SIEM, ticketing, and automation workflows.

CVEasy AI maps vulnerabilities to major compliance frameworks:

• NIST 800-53. Security and privacy controls
• SOC 2. Trust Services Criteria
• PCI DSS. Payment card industry requirements
• HIPAA. Healthcare data protection
• FedRAMP. Federal cloud security
• ISO 27001. Information security management

The platform generates audit-ready evidence packages that prove your vulnerability management program meets regulatory requirements. Reports are available as interactive HTML with drill-down capability and exportable PDF for board and auditor distribution.

When you import results from multiple scanners, CVEasy AI normalizes all findings into a unified data model using CVE IDs, CPE strings, and host identifiers. Duplicate findings are automatically merged, enriched with data from all sources, and assigned a single TRIS score. One pane of glass across your entire scanner fleet, without the spreadsheet reconciliation that plagues multi-vendor environments.

CVEasy AI generates reports in multiple formats:

• Interactive HTML. Full drill-down reports with attack surface maps, risk trend charts, and SLA compliance metrics
• PDF. Executive-ready reports with risk trend charts, MTTR metrics, and business-impact narratives for board presentation
• CSV/JSON. Raw data exports for integration with other tools and custom analysis

All reports include TRIS scoring context and remediation status tracking, and can be scoped by asset group, business unit, or compliance framework.

Pricing is public. Every number is on the pricing page. You buy an annual or monthly subscription sized by product: 1,000 assets included, or unlimited. There are no per-user or per-seat fees, and everything runs on your hardware.

Legacy vendors (Tenable, Rapid7, Qualys) meter per asset per year and keep the number behind a sales call. Ours is published. Questions about fit? Contact Sales.

No. There are four products but one platform: CVEasy (Defend) and CVEasy Red (Defend + Validate), each at 1,000-asset or unlimited scale. The product is the tier. What you buy is what ships: no lite versions, no free tier, no feature gating, nothing held back for a later upsell. Every install gets TRIS scoring, AI remediation, all scanner integrations, compliance mapping, API access, and reporting; Red products add BASzy attack validation.

We do not offer free trials. Instead, we offer a personalized demo where our sales engineering team walks you through the platform with your use case in mind. Request a demo to see CVEasy AI in action with your data.

Every CVEasy license ships the complete platform:

• TRIS v2 12-layer risk scoring engine (Patent Pending)
• Local AI remediation guidance (CVEasy AI Engine)
• All 152 integrations across 16 categories: 73 native API connectors, 43 file imports and 14 push endpoints inbound, plus 15 outbound destinations for patch orchestration, ticketing and chat, and 7 built-in engines and feeds
• Compliance mapping (NIST, SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001)
• Full REST API access
• Executive and technical reporting
• 361,000+ CVE database with enrichment

CVEasy Red products add BASzy AI breach and attack simulation: 158,271 payloads across 120 categories.

No. There are no per-scan fees, no per-IP charges, and no per-user fees. Asset count sizes the product you pick, 1,000 included or unlimited; it is not a running meter, so scanning more never generates a surprise bill. That is the structural difference from legacy platforms like Tenable, Rapid7, and Qualys, whose per-asset pricing scales with your infrastructure.

Yes. CVEasy AI offers a dedicated MSSP partner program designed for managed security providers who want to build or expand their vulnerability management practice. The program includes multi-tenant workspace support, white-label reporting, volume licensing, and partner-specific resources. Contact Sales to learn more about partnership opportunities.

Yes. CVEasy AI supports client workspaces that let an MSSP analyst manage multiple client environments from a single install. Findings, assets, and reporting are organized and scoped per client, and reports can be branded per client. This makes it straightforward to deliver white-labeled vulnerability management services at scale. Because CVEasy AI runs locally on the analyst's own machine, workspaces are an organizational boundary within that install rather than a hosted multi-tenant service.

Yes. CVEasy AI supports white-label reporting for MSSP partners. Customize reports with your brand, your client's branding, and your own executive narrative. Reports include interactive HTML with attack surface maps and exportable PDF formats suitable for board-level presentation.

MSSP licensing uses the same public products. Unlimited-asset Enterprise licensing means client growth never eats your margin, and there are no per-client charges. Volume licensing is available for partners managing multiple deployments. Contact Sales for MSSP-specific pricing.

Most MSSP tools require cloud infrastructure, meter per asset (which destroys margins at scale), and lock you into a single scanner ecosystem. CVEasy AI is different:

• Predictable licensing. Unlimited-asset Enterprise pricing means costs don't scale with how many client assets you manage
• Multi-scanner support lets you work with whatever scanners your clients already own
• Local deployment means you can offer VM services to clients who refuse cloud-connected tools
• Built-in BASzy lets you upsell attack validation without purchasing a separate BAS vendor
• White-label reporting delivers polished client-facing deliverables without extra tooling