Cybersecurity: Vulnerabilities
Triage by real-world priority, run as a loop
A CTEM-style exposure register: findings ranked by KEV, EPSS and criticality, grouped into scopes, routed to owners, clocked against SLA tiers and driven from Open to Closed — with choke-points feeding the attack path.
- 1,172 open findings, ranked by real-world risk rather than raw CVSS, so known-exploited (KEV) issues come first.
- 94% of findings fixed inside their SLA of 7, 30, 90 or 180 days, set by severity.
- 3 choke points: single hosts that most attack paths pass through, so one fix breaks many paths.
Live activity
Every lane, one deduplicated register
Events stream in across the six lanes — sweeps completing, findings opening and closing, pentest stages, tickets — and findings dedupe into one register: one finding per dedup key, so the same issue found by more than one lane is counted once.
Live activity
Every lane, deduplicated into one register
One finding per dedup key, so the same issue found by more than one lane is counted once.
Exposure dashboard
The findings that actually matter, first
A severity donut, a risk heatmap and KEV / EPSS / public-exploit intel put the dangerous findings at the top — not the loudest CVSS.
Vulnerability Command Center
Open findings on the 318 internet-facing assets, ranked by real-world priority
Finding detail
One CVE, every scoring field
CVE and CWE, the CVSS v3.1 vector and base, EPSS score and percentile, CISA KEV, public-exploit counts, the blended effective risk, the SLA tier and due date, and the status lifecycle.
Finding detail · VULN-2388
Windows Print Spooler RCE (PrintNightmare)
- Affected host
- dc-01, port 445
- Owner
- Identity team, IT Security
- Fix
- Install KB5005010, disable the Print Spooler
Guided tour: step 1 of 4
CVSS 8.8: how severe it is
- What it means
- The standard severity score from 0 to 10. PrintNightmare scores 8.8, which is high.
- Why it matters
- It tells you how bad an exploit would be, not how likely one is.
- What to do
- Read it together with EPSS and KEV, never on its own.
CTEM scopes
Exposure management as a cycle
Scope, Discover, Prioritise, Validate, Mobilise — one explicit loop at a time, so exposure is a program and not a one-off scan.
CTEM — Continuous Threat Exposure Management
One scope, run as an explicit cycle
Choke-points
The one hop that breaks the most paths
The register ranks the findings that sit on the most attack chains. Fix the top choke-point and many routes to the crown jewel collapse at once.
Choke-point analysis
Hosts ranked by how many of the 17 proven attack paths pass through them
Patch dc-01 and 9 of the 17 paths break, including 3 of the 4 that reach the finance database. No other single fix closes as many.
Departments & routing
Every finding has an owner
Findings route to the owning team by rule, each with its SLA and attainment, so nothing sits unassigned.
Routing & SLA policy
Administrator · service desk
SLA tiers
Seven, 30, 90 and 180-day clocks
Each severity has a remediation deadline and a target attainment. Breaches escalate and raise a Help Desk ticket automatically.
Remediation SLA tiers
Attainment vs 90% target · by severity
Lifecycle & exceptions
Open to Closed, with every exception on the record
A finding moves through explicit states, and anything accepted is accepted deliberately.
Open → In Progress → Remediated → Verified → Closed
Plus Risk Accepted and False Positive — the full, honest set of outcomes.
Exceptions, governed
Risk acceptance is time-boxed, owned and reviewable, not a quiet suppress.
Reports
Export the register by severity, owner and SLA state for the audit.
See Vulnerabilities on your estate
Tell us a little about your environment and we’ll put together a walkthrough tailored to it.
- Agentless discovery
- Real-world prioritisation
- Human-gated proof