The number one local-first CTEM platform
Rank your scanner findings, prove what an attacker can reach, then find the flaw that has no CVE yet
- Unify
- CVEasy unifies the findings your scanners produce into one queue and ranks them with TRIS.
- Prove
- In CVEasy Red, BASzy tests your systems the way an attacker using AI would. When a step finds something, a local model picks the next move, and BASzy proves what is reachable on systems you authorize.
- Hunt
- Zero-Day Discovery, licensed separately, looks past the CVE list by testing your own running applications for insecure code that has no CVE yet.
- Runs on
- AI analysis runs on your hardware by default.
One queue, ranked by TRIS
Every product
Illustrative
| Finding | TRIS |
|---|---|
| CVE-2024-3094 XZ Utils backdoor | 95 |
| CVE-2024-38077 Windows Remote Desktop Licensing | 92 |
| CVE-2024-21762 FortiOS SSL VPNProved reachable by BASzy, CVEasy Red | 88 |
| CVE-2023-44487 HTTP/2 Rapid Reset | 64 |
No CVE CWE-89 SQL injection
Zero-Day Discovery result, licensed separately
- TRIS 3 risk scoring, 0 to 100
- 158 integrations, 15 categories
- 328,000+ CVEs, synced daily
- All 5 Gartner CTEM stages, with Validate in CVEasy Red
- 158,271 BASzy attack payloads in CVEasy Red
The attacker moved to flaws with no patch yet
When exploitation starts, counted from the day the patch was released
Mandiant’s average went from 63 days after the patch (2018 to 2019) to an estimated 7 days before it (2025).
Sources: Mandiant’s 2023 time to exploit analysis (Google Cloud, October 15, 2024) for 2018 to 2023; its 2023 average excludes 15 outliers the authors identified. Mandiant M-Trends 2026, as reported by Help Net Security (March 24, 2026) for 2024 and the 2025 estimate. Each point is the average for the period labeled.
Show the numbers
| Period | Average timing | Source |
|---|---|---|
| 2018 to 2019 | 63 days after the patch | Mandiant, Google Cloud, October 2024 |
| 2020 to early 2021 | 44 days after the patch | Mandiant, Google Cloud, October 2024 |
| 2021 to 2022 | 32 days after the patch | Mandiant, Google Cloud, October 2024 |
| 2023 | 5 days after the patch | Mandiant, Google Cloud, October 2024; 15 outliers excluded |
| 2024 | 1 day before the patch | Mandiant M-Trends 2026 |
| 2025 | 7 days before the patch, estimated | Mandiant M-Trends 2026 |
Ranking what your scanners found tells you which published flaws to fix first. When exploitation starts before the patch, you also need to know what an attacker can reach, and which flaws have no CVE yet.
Vulnerability management was built on two assumptions: one severity number can decide what to fix, and a patch will exist before the exploit does. Since 2024, Mandiant’s average has the exploit arriving before the patch.
Key takeaways
- Vulnerability exploitation has overtaken stolen credentials as the most common way attackers get in, per Verizon’s 2026 Data Breach Investigations Report.
- The same report found only 26 percent of the vulnerabilities on CISA’s known exploited list had been fully remediated. Its median time to fully patch a vulnerability was 43 days.
- Attackers have started using AI to build exploits and run intrusions. In May 2026, Google’s Threat Intelligence Group said it has high confidence that an attacker built a zero day exploit with help from an AI model. In November 2025, Anthropic reported an intrusion campaign in which AI performed 80 to 90 percent of the work.
A list of known issues cannot contain the one nobody reported
Exposure platforms unify the findings your scanners produce and rank them, and some now validate a curated set of known issues too. CVEasy unifies and ranks with TRIS in every product. In CVEasy Red, BASzy runs the attack on your systems before an attacker does, and a local model adapts the chain to what BASzy finds. Zero-Day Discovery, licensed separately, tests your own running app for insecure code that no CVE describes yet.
The list an exposure platform ranks
Known issues
Findings your scanners produced
Deduplicated onto one asset graph and ranked again with context.
A curated exploit set
Some platforms run safe exploits against a known list. Qualys, for one, says its agent covers over 1,600 CVEs.
The unreported flaw
No CVE, so it reaches the ranked list only if a separate code scan, web app test, or pentest reports it.
Every CVE on it started as a published disclosure.
What CVEasy unifies, proves, and hunts
One local app
Unify
Every product
158 integrations across 15 categories, one deduplicated queue.
Prove
CVEasy Red
BASzy chains attack steps and shows which findings an attacker can reach.
Hunt
Zero-Day Discovery, licensed separately
A behavioral audit of your own running app surfaces insecure code with no CVE yet.
Runs on
Your hardware. AI analysis is local by default.
All five Gartner CTEM stages, with Validate in CVEasy Red.
- Scope
- Discover
- Prioritize
- Validate
- Mobilize
The left column reflects publicly documented exposure platforms.
Run the attack, then run it again after the fix
In CVEasy Red
BASzy is the attack validation engine inside CVEasy Red and CVEasy Red Enterprise. It runs attack techniques against a target you authorize, so you fix what an attacker can reach.
FortiOS SSL VPN, traced from the queue above
Illustrative
CVE-2024-21762
CVSS 9.8TRIS 88CISA KEV since Feb 9, 2024
Proved reachable by BASzy, CVEasy Red
- BASzy
- chain reached the objective
- Fix
- patch applied on a host you authorized
- Retest
- same chain run again, path closed
The next step depends on what the last one found
BASzy starts from a preset sequence of attack modules. When a step turns something up, CVEasy’s local model plans what to try next, the way an attacker using AI would, and BASzy chains those steps into a multistep attack. It draws on 158,271 attack payloads across 120 categories, mapped to MITRE ATT&CK.
See how BASzy chains an attackTen campaigns from ransomware to cloud
CVEasy Red ships 10 prebuilt attack campaigns spanning ransomware, APT tradecraft, Active Directory, and cloud. BASzy simulates any destructive step in a campaign instead of running it.
Proof a flaw is reachable
A chain that reaches its objective proves the exposure is exploitable in your network, and TRIS moves the finding up the queue.
Scope
BASzy tests only targets you own or are authorized to test, and every run is logged against the authorization that covers it.
Look past the CVE list into your own running app
Zero-Day Discovery, licensed separately
The 0-Day Audit in BASzy Zero-Day Discovery watches how your own running application behaves and surfaces insecure code that has no CVE yet.
SQL injection with no CVE, traced from the queue above
Illustrative
No CVE
CWE-89SQL injection
Zero-Day Discovery result, licensed separately
- 0-Day Audit
- deterministic checks confirmed it on your running app
- TRIS
- scored in the same queue as your CVEs
Hypotheses specific to your stack
When CVEasy’s local model is available, it proposes 0-Day Audit hypotheses for your stack, and deterministic checks decide which ones are real.
A reproducer with every fuzzer finding
The Web Fuzzer in Zero-Day Discovery hands over each finding with a curl command and a Python script that reproduce it, so a result is something an engineer can run rather than a screenshot to argue about.
How to get Zero-Day Discovery
It attaches to any CVEasy edition. The CVEasy team turns it on for your license after a conversation about scope, and it runs only against targets you authorize.
CVEasy AI Research finds the flaws nobody has reported yet
Looking past the CVE list is how the research team works. Its disclosure portfolio spans findings reported through a CNA, fixes posted upstream by maintainers, and flaws in open source AI projects still inside their disclosure windows.
Every finding follows the published disclosure policy: the vendor hears first, the window runs up to 90 days or until a fix ships, and the CVE comes through the vendor’s CNA or through MITRE.
What the research keeps showing
One of the team’s reports came back a duplicate: another researcher, working with an AI agent, had filed the same flaw a few hours earlier. Flaws like that sit in plain sight until someone tests for them, and the next one to test may be an attacker with the same kind of tools.
The same gap shows up in well tested code. A flaw the team reported in QEMU, which Google’s OSS-Fuzz fuzzes continuously, sat in a device model no fuzz configuration reached, and its Red Hat maintainer posted the fix upstream. Automated coverage has edges, and CVEasy tests your own systems past them before someone else does.
More you can check
Threat intel
A signed weekly bundleEvery week CVEasy AI publishes a free ED25519 signed threat intel bundle, and the app verifies the signature before importing it.
Blog
An exposure chart you can checkThe week 38 chart tracked seven CVEs rated 7.8 or higher, all under confirmed exploitation, and for five of them attacks landed before a patch existed.
TRIS ranks the queue and CVEasy writes the fix
In every product
Findings from your scanners, EDR, cloud, and AppSec tools feed one queue. CVEasy writes the fix as commands specific to each operating system, with a rollback, and hands the work off to Jira, ServiceNow, or GitHub.
CVEasy works with 158 integrations across 15 categories and deduplicates the findings they bring in onto one asset graph. It indexes 328,000+ CVEs, synced daily.
The likelihood
Five inputs to a model fitted on which CVEs later landed on CISA KEV.
- EPSS exploit probability
- CVSS base severity
- Age since publication
- Network reachable without authentication
- Vendor reports of exploitation
Your context and proof
What your environment adds, and what lowers or locks the score.
- Asset criticality and crown jewels
- Internet exposure and environment
- Spread and blast radius
- Verified controls and BAS test results, which only lower it
- Confirmed exploitation, which lifts it into ACT
TRIS 3 gives every finding a score on a 0 to 100 scale, a priority band, and an SLA. Adding risk never lowers the score.
The inversion
A CVSS 6.5 reachable from the internet on a revenue critical asset can outrank a CVSS 9.8 on an internal box with no path to it.
TRIS weighs reachability and business context next to severity. CVSS is one input among several.
Score a CVE in TRIS Lab, freeWhat each product includes and how CVEasy compares
Unify, TRIS, remediation, and reporting come in every product. BASzy attack validation and the retest after the fix come with CVEasy Red. Zero-Day Discovery is licensed separately.
Unify
Your scanner findings land in one queue, ranked with TRIS.
Every product
Prove
BASzy runs the attack chain and proves what is reachable.
CVEasy Red
Hunt
The 0-Day Audit tests your own running app for insecure code with no CVE yet.
Zero-Day Discovery, licensed separately
Fix
CVEasy writes the commands and the rollback, then hands off to Jira, ServiceNow, or GitHub.
Every product
Retest
The same chain runs again to confirm the path is closed.
CVEasy Red
| Product | What you get |
|---|---|
| CVEasy Core, Starter, CVEasy and CVEasy Enterprise (Defend) | One queue for your scanner findings, TRIS ranking, remediation, and reporting. 50 assets in CVEasy Core (no AI assistant or executive reporting), 250 in CVEasy Starter, 1,000 in CVEasy, unlimited in CVEasy Enterprise. |
| CVEasy Red and CVEasy Red Enterprise (Defend and Validate) | Everything in Defend, plus BASzy attack validation, multistep chains, custom payloads, and the retest after the fix. 1,000 assets in CVEasy Red, unlimited in CVEasy Red Enterprise. |
| BASzy Zero-Day Discovery, licensed separately | Attaches to any edition and looks past the CVE list in your own running app. Turned on per license, after a conversation about scope. |
| Capability | Exposure platformsEAP, aggregators | Attack validation toolsAEV, BAS | CVEasy AIone local app |
|---|---|---|---|
| Unify scanner findings into one queue | Core job | Not the focus | 158 integrations, 15 categories |
| Rank by context | Their own risk score | By proven risk | TRIS 3, backtested against KEV |
| Validate known issues | Growing, on a curated set | Known techniques | BASzy, in CVEasy Red |
| Look past the CVE list | Some web app testing | Some web app testing | 0-Day Audit of your own running app, licensed separately |
| Fix, then prove the fix | Some revalidate | Some retest | Fix commands in every product, retest in CVEasy Red |
| Runs on your hardware | Cloud or on prem | Cloud or on prem | Local by default |
Based on publicly documented products of each type.
Local first
- On device
- Local AI analysis by default. Cloud AI only with your own key.
- No upload path
- Scan results, findings, asset inventories, and reports have no upload path to us.
- Sized by assets
- Asset count sizes the product you pick, 1,000 included or unlimited. It is not a running meter.
- One file
- SQLite under the hood. Back it up with cp, move it on a USB drive.
The questions a security team asks first
Is it safe to run on production?
Start in staging. BASzy simulates destructive campaign steps instead of running them, but a campaign still sends attack traffic to its target, so clear any production run with change management first. Each module documents what it tests and what traffic it generates.
What stops it from attacking the wrong thing?
Before any module runs, BASzy checks that the target is in scope and has an active authorization. Every run is logged against that authorization, with the name of the person who granted it.
Where does our data go?
Scan results, findings, asset inventories, and reports leave your hardware only through integrations or cloud AI you switch on, and then only to accounts you hold. None of them has an upload path to us. AI analysis runs locally by default, and cloud AI needs your own key. The Trust Center itemizes what does cross the boundary, such as license checks, version checks, and the signed intel bundle.
Does this replace our scanner or our pentest?
No. CVEasy’s own discovery runs beside your enterprise scanner as a second source of truth, and CVEasy does not stand in for a compliance pentest from an outside firm.
From a customer running it
“The reporting engine in CVEasy AI is F**KING AMAZING.”
See it run against a host you own
Book a walkthrough and the CVEasy team will run it against that host, on local hardware.