Pricing · live & public

The price is on the page, not behind a sales call

Q: How do I block a CI/CD build on an exploited vulnerability?

Call GET /v1/cve/{id} for each CVE your dependency scanner reports and fail the job when tris_band is ACT or is_kev is 1. That stops builds for vulnerabilities attackers are actually using, instead of every high CVSS score.

Products: Defend, defend and validate, or just the API.
Scale: 50, 250 or 1,000 assets, or unlimited.
Runs on: Your own hardware, no cloud, no per-seat fees.
To see a price: Scroll down.

2 months free

1,000-asset estate · annual

Tenable-class$00,000/yr

Qualys-class$00,000/yr

Rapid7-class$00,000/yr

CVEasy$7,450/yr

We can’t print their numbers because they don’t publish them.

Act I · Defend

CVEasy

Every signal you already have, scanner findings, NVD, EPSS, CISA KEV, threat intel, and your own asset context, scored by TRIS 3 into one number you can act on.

The same five CVEs, re-ranked: CVSS scores severity, TRIS scores your risk

Re-prioritized up: reachableDropped: not reachable here

Defend · Core

CVEasy Core

Includes 50 assets

Scanner connectors and file import
TRIS™ 3 prioritization and Fix First remediation
CSV and PDF findings export
Runs entirely on your own Mac
No AI assistant
No executive or compliance reporting
No SIEM and IDR connectors

Core sends anonymous daily usage counts as a condition of the plan, never hostnames, IP addresses, CVE IDs or file names. What is sent

Buy CVEasy Core

Best value

Defend · Starter

CVEasy Starter

Includes 250 assets, five times Core

All included, nothing to add onThe local AI assistant, executive and compliance reporting, and the full connector set, SIEM and IDR included.

Everything in Core, plus:
Local AI assistant: remediation guidance and chat over your findings
Executive, compliance and board reporting
Every connector, SIEM and IDR included, plus ticket hand-off
No usage data sent

Buy CVEasy Starter

Defend

CVEasy

Includes 1,000 assets

Everything in Starter, for 1,000 assets:
Full CTEM core: discover, prioritize, remediate, report
Local AI assistant, reporting and scanner connectors included
Ticketing hand-off to Jira, ServiceNow, and GitHub
No usage data sent
Runs entirely on your hardware

Buy CVEasy

Each plan is one installer with everything in it: nothing to unlock and no add-ons. Proof that a finding is exploitable comes with CVEasy Red, below.

Act II · Defend + Validate

CVEasy Red

Everything in CVEasy, plus BASzy™ runs the attack for real: web and network simulation, multi-step chains, custom payloads. After you fix, it re-tests and confirms the path is closed.

CVEasy Red

Includes 1,000 assets

Everything in CVEasy, plus BASzy™ attack validation:
Web and network attack simulation
Spotlight assessments and multi-step chains
Custom payloads
Post-fix validation that proves the fix worked

Buy CVEasy Red

Over 1,000 assets? Both products come without an asset cap, below.

Act III · At estate scale

No asset cap

CVEasy and CVEasy Red for the whole environment, with priority support.

Defend · Estate

CVEasy Enterprise

Includes unlimited assets

Everything in CVEasy, at estate scale:
No asset cap, score the entire environment
Priority support

Buy CVEasy Enterprise

Defend + Validate · Estate

CVEasy Red Enterprise

Includes unlimited assets

The full platform, no limits:
Everything in CVEasy Red
No asset cap, validate the entire estate
Priority support

Buy Red Enterprise

Checkout via Stripe · keys delivered by email within 48 business hours · cancel anytime · refund & cancellation policy

Act IV · No install required

TRIX™ API

Don’t need the whole app? Plug the intelligence CVEasy runs on straight into your own pipeline. One REST call returns a CVE’s TRIS™ score, CISA KEV status, EPSS, public exploit availability and the threat actors with documented use of it. Free key in a minute, no installer, no agent.

trix.cveasyai.com

$ curl -H "Authorization: Bearer $TRIX_KEY" \
  https://trix.cveasyai.com/v1/cve/CVE-2021-44228

{
  "id": "CVE-2021-44228",
  "tris_baseline": 95,
  "tris_band": "ACT",
  "cvss_score": 10,
  "epss_score": 0.99999,
  "is_kev": 1,
  "kev_date_added": "2021-12-10",
  "has_public_poc": 1
}  # abridged

# CI gate: fail the build on anything exploited or in ACT
$ curl -s -H "Authorization: Bearer $TRIX_KEY" \
  https://trix.cveasyai.com/v1/cve/$CVE \
  | jq -e '.tris_band != "ACT" and .is_kev == 0'

Gate your CI/CD pipeline

Fail the build when a dependency CVE lands in the ACT band or on CISA KEV, not on every CVSS 7 that will never be exploited.

Enrich SIEM and SOAR alerts

Add exploited-in-the-wild status, EPSS and named threat actors to an alert before an analyst opens it.

Rank the patch backlog

Score your scanner export with TRIS from a script and send tickets in the order an attacker would care about.

Power your own product

Show TRIX scores to your own customers under a Scale licence, with score history and webhooks when a CVE crosses into ACT.

TRIX · Free

Community

$0/month

No card needed

1,000 calls a day

CVE records, TRIS baseline, CISA KEV and EPSS
Threat actors with documented use, chain facts
Delta sync to keep a local copy current
Personal, research and your own organization

Get a free key

TRIX · Developer

Developer

$49/month

Annual $490/yr on request

10,000 calls a day

Everything in Community, plus:
Ten times the volume, 200-record pages
Heuristic threat actor matches
Chain resolution and validated chains
Email support

Start Developer

For teams

TRIX · Pro

Pro

$495/month

Annual $4,950/yr on request

100,000 calls a day

Everything in Developer, plus:
Commercial license: build it into products and client services
Contextual TRIS scored against your own assets
Bulk snapshots and three keys
Support within one business day

Start Pro

TRIX · Scale

Scale

$1,490/month

Annual $14,900/yr on request

500,000 calls a day

Everything in Pro, plus:
Show TRIX data to your own customers
Score history for every CVE
Webhooks when a CVE crosses into ACT
Ten keys and priority support

Start Scale

TRIX Enterprise · 2,000,000 calls a day, redistribution rights, BASzy™ offensive intel and 25 keys. From $2,500 a month on an annual contract.Talk to us →

Already a CVEasy customer? Your licence includes a TRIX key at no extra cost: Starter includes Developer, CVEasy and CVEasy Red include Pro, the Enterprise and MSSP editions include Scale, and Core includes Community. Sign in with your licence email to create it.

Start free on the account page and upgrade there in one click; your existing keys move to the new limits within a minute · API docs · API terms

Cost comparison

The 1,000-asset math

What a year of exposure management costs for a 1,000-asset estate. Incumbents charge $15K to $30K per year for overlapping capability across scanner, prioritization, and validation tools.

CVEasydefend

$7,450

CVEasy Reddefend + validate

$14,900

Typical incumbent stackoverlapping tools

$15K to $30K

Bars share one scale from $0. Incumbent range reflects typical annual pricing for comparable enterprise coverage; your renewal quote may vary.

Put your renewal quote next to ours

Feature matrix

Every number, side by side

The product is the tier: what you buy is what ships, and there is nothing to unlock later.

	CVEasy Core	CVEasy StarterBest value	CVEasy	CVEasy RedMost popular	CVEasy Enterprise	CVEasy Red Enterprise
Annual	$490	$3,950	$7,450	$14,900	$34,650	$49,500
Monthly	$49	$395	$745	$1,490	$3,465	$4,950
Included assets	50	250	1,000	1,000	Unlimited	Unlimited
Scanner connectors, TRIS scoring, Fix First, findings export	✓	✓	✓	✓	✓	✓
Local AI assistant	—	✓	✓	✓	✓	✓
Executive and compliance reporting	—	✓	✓	✓	✓	✓
SIEM and IDR connectors	—	✓	✓	✓	✓	✓
BASzy™ attack validation	—	—	—	✓	—	✓
Post-fix validation	—	—	—	✓	—	✓
Priority support	—	—	—	—	✓	✓
Anonymous usage data	Required (details)	None	None	None	None	None

Checkout

How buying works

Self-serve checkout, or talk to us first. Either way you end up with the same license key.

STEP 1

Pick your product

Defend or defend + validate; 50, 250 or 1,000 assets, or unlimited. Not sure? Request a demo and we’ll scope it with you.

STEP 2

Check out with Stripe

Card details go to Stripe, never to us. Monthly or annual, with two months free on annual.

STEP 3

Delivered by email

Your license key and a single-use installer link arrive within 48 business hours, usually much sooner. Activate and start scoring.

FAQ

Questions

What counts as an asset?

A distinct IP-routable target that CVEasy has ingested within the last 30 days. Assets not seen for 30 days deactivate automatically and stop counting, so decommissioned hosts never linger on your bill.

How does renewal work?

Monthly plans renew monthly, annual plans renew annually, and we email you before every renewal. Cancel any time with effect from the end of the current term. Details are in the Refund & Cancellation Policy.

What if I outgrow my plan’s assets?

Nothing breaks. There is built-in headroom for scan-time drift. When you genuinely outgrow it, moving up the ladder, from Core to Starter to CVEasy to an Enterprise product, is a same-day conversation.

Are there add-ons?

No. Each plan is one installer with everything in it. Core is the one plan without the AI assistant, executive and compliance reporting, and SIEM and IDR connectors; Starter and every plan above it include all three.

Can I use CVEasy without installing the app?

Yes. The TRIX API gives you the same CVE intelligence the app runs on, TRIS risk scores, CISA KEV status, EPSS and the threat actors with documented use of a CVE, over a REST API you call from your own pipeline, SIEM or scripts. The Community tier is free with 1,000 calls a day; create a key and see the API docs.

How do I block a CI/CD build on an exploited vulnerability?

Call GET /v1/cve/{id} for each CVE your dependency scanner reports and fail the job when tris_band is ACT or is_kev is 1. That stops builds for vulnerabilities attackers are actually using, instead of every high CVSS score. A free Community key covers most single-project pipelines.

Is the TRIX API included with a CVEasy licence?

Yes, for the same email address and at no extra cost: Starter includes TRIX Developer, CVEasy and CVEasy Red include TRIX Pro, the Enterprise and MSSP editions include TRIX Scale, and Core includes Community. The tier follows the licence automatically.

Does my data go to your cloud?

No. The application, database, analysis engine, and AI model all run on your machine. There is no upload path for scan results, findings, or reports. The one exception is CVEasy Core, which sends anonymous daily usage counts as a condition of its lower price, never your findings, hostnames, IP addresses or CVE IDs: see exactly what is sent. More in the Trust Center.

Air-gap cleared

Government & Defense

Dedicated builds including fully air-gapped operation for federal civilian, DoD, and the defense industrial base. Priced per engagement.