TRIS 3 scores every vulnerability from how likely it is to be exploited, backtested against later CISA KEV additions, plus what your environment says about it. Know exactly what to patch first.
Thirty seconds on why TRIS scores the vulnerability you actually run, not the one in the database.
CVEasy AI · TRIS scoring · 0:30
When everything is "critical," nothing is. Your analysts are drowning in noise while real threats hide in the backlog.
Based on CVSS alone, nearly 30% are "Critical"
CVSS was designed to measure technical severity, not business risk. It tells you HOW BAD a bug could be, not whether anyone is actually exploiting it or if it even affects your environment.
The result? Security teams burn weeks patching theoretical "Critical" vulnerabilities while actively exploited, moderate-scoring bugs slip through.
One function scores a finding on an asset and a CVE in the catalogue, in four stages. There is no weighted average, so each input moves the score only in its own direction: adding risk never lowers it and adding a mitigation never raises it. TRIS 3 replaced the twelve-layer TRIS v2 in release 1.7.4. The v2 white paper remains as the record of the earlier model.
The probability a CVE is added to CISA KEV, from a logistic model over EPSS, CVSS, age, network reachability without authentication, and vendor reports of exploitation. Fitted on four point-in-time EPSS snapshots with later KEV additions as the label. In a leave-one-date-out backtest it reached ROC-AUC 0.89 to 0.92, against 0.83 to 0.87 for TRIS v2 and 0.67 to 0.73 for EPSS alone at the time. An unknown EPSS or CVSS takes the population average, so missing data never reads as safe.
Finding-specific verdicts (blocked by a control, not reachable, does not apply, patched) and verified controls such as EDR, WAF, MFA and network segmentation multiply the likelihood down. They never push it up.
Fixed points for asset criticality, crown-jewel proximity, internet exposure, environment and spread across your estate. Context you have not recorded adds nothing: unknown is neutral, never a discount.
CISA KEV, a threat actor documented using the CVE, BASzy proof, or exploitation observed in your environment lifts the finding into ACT and keeps it ordered there. Only a finding-specific verdict can waive it.
See how TRIS transforms a panic-inducing CVSS score into an actionable, contextualized priority.
Windows TCP/IP Remote Code Execution. CVSS says: drop everything and patch immediately across your entire fleet.
TRIS 3 weighed the likelihood and your context and determined: this is not an emergency for YOUR environment right now.
This is one example. Every organization gets different TRIS scores based on their unique asset exposure, business context, and threat landscape.
TRIS maps every vulnerability into actionable SLA bands so your team always knows the timeline.
SLA windows are defaults. Fully configurable per organization, asset group, or compliance framework.
Each scoring system was designed with a different purpose. TRIS uses both as inputs and adds your environment.
| Capability | TRIS™ | CVSS v3.1/4.0 | EPSS |
|---|---|---|---|
| Technical severity | ✓ | ✓ | ✗ |
| Exploitation probability | ✓ | ✗ | ✓ |
| Active exploitation (KEV) | ✓ | ✗ | ✗ |
| Business context | ✓ | ✗ | ✗ |
| Your asset exposure | ✓ | ✗ | ✗ |
| Threat campaign data | ✓ | ✗ | Partial |
| Vulnerability age | ✓ | Optional metric | ✗ |
| Actionable SLA bands | 4 bands with timelines | 4 static labels | Raw percentage |
| Environment-specific | Unique per org | Same for everyone | Same for everyone |
| Auto-remediation guidance | ✓ AI-generated | ✗ | ✗ |
CVSS and EPSS are valuable inputs. TRIS 3 uses both inside its likelihood model. The difference is that TRIS 3 also adds your environment: asset criticality, exposure, verified controls, and exploitation confirmed by CISA KEV, threat actors, or BASzy.
Once TRIS tells you what to patch first, CVEasy AI generates the exact fix commands for your operating systems.
TRIS scoring does not stop at prioritization. For every vulnerability that needs action, CVEasy AI's local LLM generates step-by-step remediation tailored to your actual environment.
See how TRIS 3 scoring transforms your vulnerability management program: one score, one clear answer.