Methodology

Separate dimensions

Severity (CVSS), known exploitation (CISA KEV), exploitation probability (EPSS) and the priority for each environment are different dimensions. A critical vulnerability is not always the most urgent one for you; a medium one listed in KEV may be.

Validation

1. Alerts only start an investigation; the CVE is looked up in official sources.
2. Every observation is stored with its collection date and content hash.
3. Deterministic rules check the identifier, official confirmation, CVSS origin, product evidence and source conflicts.
4. Items with open issues go to human review; AI never decides on its own whether a technical claim is true.

What we show — and what we do not

Unconfirmed fields are shown as unknown. We do not infer that intermediate versions are affected without evidence, we do not treat a missing fixed version as a missing fix, and we do not display percentages that suggest non-existent precision.

Triage guidance

The "First 24 hours" and "Detection" sections are derived by rules from the record itself (CVSS vector, weakness class, KEV). They are starting points, not rules tested in your environment.

AI-assisted content

Analyses and translations may be produced with AI assistance from structured data. Every output is schema-validated, cannot introduce references, versions or CVSS absent from the sources, and is labeled as such. Content with open issues goes through editorial review.