Threat intelligence that tells you what to act on
A feed that lists thousands of CVEs is noise. CVEasy AI publishes a free, weekly, cryptographically signed bundle of the vulnerabilities that are actually worth acting on, with CISA KEV, EPSS and evidence-grade threat actors, and it works fully offline. No account required.
Free · Signed · Air-gap capable
The CVEs that need action, not a data dump.
The free bundle is the same intelligence that drives the product, published openly.
Most threat feeds optimize for volume. CVEasy optimizes for decisions. The free weekly bundle carries the vulnerabilities sitting in the TRIS™ ACT band, enriched with CISA KEV status, EPSS probability and evidence-grade threat-actor context, so you can see what to act on at a glance.
There is also a live board at cveasyai.com/threat-intel where you can look up any CVE by ID and see its enrichment, exploit prerequisites and the actors with documented ties. No account, no gate.
- The ACT band: the CVEs TRIS™ ranks as act-now in a real environment
- CISA KEV: known-exploited status, the strongest signal a real actor already weaponized it
- EPSS: exploit-probability scoring to sort what is likely to be hit
- Threat actors: documented, evidence-grade ties rather than generic sector lists
- Weekly cadence: a fresh signed bundle every week
- Offline ready: import it into an air-gapped CVEasy install
Intelligence you can verify before you trust it.
A feed you cannot verify is a feed you have to trust blindly.
Every bundle is signed with Ed25519. The CVEasy desktop app verifies the signature against its embedded public key before it imports anything, so a tampered or substituted feed is rejected rather than ingested. This is what makes the feed safe to carry across an air gap: the integrity travels with the file.
That same discipline runs through the product. Signed feeds, a signed and hash-chained audit ledger, and on-box processing are the same idea applied in three places: you should be able to prove what you ingested, what you did, and where it happened.
The TRIX API, free to start.
When you want the intelligence in your own tooling.
For CI/CD pipelines, SIEMs and scripts, the TRIX threat-intel API serves CVE risk scores, CISA KEV, EPSS and threat-actor data programmatically, free to start. Pricing and terms are published at cveasyai.com/pricing and documented at the API reference.
Gate a build on whether a dependency carries a CVE in the ACT band, enrich SIEM alerts with KEV and EPSS context, or feed an air-gapped CVEasy install from the signed weekly bundle. Start with the free board and bundle.
Questions, answered.
The questions practitioners actually ask.
Is the threat intelligence really free?
Yes. The weekly signed bundle and the live lookup board at cveasyai.com/threat-intel are free and require no account. The TRIX API is also free to start, with published pricing for higher-volume use.
What makes this feed different from a normal CVE list?
It is ranked for action. Instead of every CVE, it surfaces the ones in the TRIS™ ACT band, enriched with CISA KEV, EPSS and evidence-grade threat actors, so it tells you what to do rather than just what exists.
Why is the bundle signed?
It is signed with Ed25519 so you can verify it has not been tampered with. The CVEasy app checks the signature against its embedded public key before importing, which is what makes the feed safe to carry across an air gap.
Can I use it in an air-gapped environment?
Yes. Download the signed bundle on a connected machine, carry it across, and import it into an offline CVEasy install; the signature is verified on import.
Can I pull it into my own tools?
Yes. The TRIX API serves CVE risk scores, CISA KEV, EPSS and threat-actor data for pipelines and SIEMs, free to start. See the API reference under cveasyai.com/threat-intel.
Get the free signed feed.
Weekly, verifiable, air-gap capable. No account required.
Mac-native · local-first · your data never leaves the box