The CVEs on your assets, with their vendors and the exploited first.
Matches the critical and high CVEs (published vulnerabilities) on your assets with the vendors that own them and puts actively exploited ones (KEV, CISA's catalog) first. It syncs daily with NVD, KEV and EPSS (exploitation probability).
For: CISOs and vendor managers who need to know which known vulnerabilities touch their inventory and which third party to ask first.
- Daily sync with NVD, CISA KEV and EPSS
- ATT&CK® techniques from your open CVEs, not detection
My exposureEntity A
Sample dataCVE-2099-0101
vpn-gateway 4.2Vendor A and Vendor C
Critical 9.8In KEVYes
CVE-2099-0102
erp-portal 11.0Vendor B
High 8.1In KEVNo
CVE-2099-0103
sftp-client 3.1Vendor A
High 7.5In KEVNo
MITRE ATT&CK® techniques from your CVEs
- T1195 Supply chain
- T1190 Exposed application
- T1199 Trusted relationship
The CTID maps techniques to CVEs in CISA's KEV catalogue. A mapping does not mean you were attacked.
From a published CVE to your exposure list
The path from a vulnerability to the vendor you should ask, and what each step does not cover.
It syncs every day
A daily process pulls CVEs from NVD (by the CPE of your assets), marks the ones in the CISA KEV catalogue and adds the EPSS score.
Scope. It is a daily sync, not a continuous flow.
It is matched with your inventory
«My exposure» shows the open critical and high CVEs on your assets, grouped with the affected vendors. Only those linked to an active vendor appear.
Scope. What is not in your inventory does not appear.
Exploited ones come first
The order puts CVEs from CISA's KEV catalogue first, that is, the ones already being exploited, and the rest after.
Scope. It is a reading order to decide whom to ask, not a prediction.
You see what is rising this week
CVEs trending over the last seven days on your own inventory, with their CVSS and a link to NVD.
Scope. It is best effort: if the query fails, the panel says so instead of showing a zero.
MITRE ATT&CK®, from your own CVEs
The radar's ATT&CK tab shows the techniques that the Center for Threat-Informed Defense (CTID) maps to the open CVEs on your assets. It adds context when prioritising; it is not a detector.
- What it shows
- The ATT&CK techniques reached from the open CVEs on your assets, grouped by tactic, with the mapping type (exploitation technique, primary impact or secondary impact) and the CVEs behind each technique.
- Where it comes from
- ATT&CK 16.1 (Enterprise) and the CTID mapping set for CISA's Known Exploited Vulnerabilities catalogue, version of 28 July 2025. A CVE outside that set has no technique: none is assumed, and it is listed as unmapped.
- What it is not
- A mapping says how a vulnerability is exploited or what it can lead to, not that you were attacked. It does not detect techniques on your systems or map your incidents to ATT&CK.
- Availability
- It is an add-on feature: without it enabled, the panel appears empty.
- Attribution
- MITRE ATT&CK® content: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. CTID Mappings Explorer: © 2024 MITRE. Approved for public release. Document number CT0104. Licensed under the Apache License, Version 2.0.
What the radar is and what it is not
So you know which data it works with and where it ends.
What it does
- Matches the critical and high CVEs on your assets with your vendors.
- Puts actively exploited CVEs (KEV) first.
- Syncs daily with NVD, CISA KEV and EPSS.
- Shows the CVEs trending on your own inventory.
What it is not
- It is not a source of sector threat intelligence: it starts from your assets.
- It does not detect ATT&CK techniques on your systems or map your incidents to them.
- It does not raise alerts of its own: it is a view for prioritising.
- It does not discover your surface: it works on the inventory you have loaded.
How it connects to the other solutions
The radar feeds the vendor's score and gives the conversation with them an order.
Exposure radar: straight questions
The ones asked by people who want to know what it covers and what it does not.
Is it threat intelligence for my sector?
No. The radar starts from your assets and your vendors: it tells you which known CVEs affect you, not what is happening in your sector.
How often does it update?
The CVE sync is daily, with NVD, the CISA KEV catalogue and the EPSS score. It is not a continuous flow.
What does KEV mean?
It is CISA's catalogue of actively exploited vulnerabilities. The radar puts those CVEs first and they weigh more in the vendor's score.
Does it identify attacks or map my incidents to ATT&CK?
No. The MITRE ATT&CK® tab shows the techniques that the CTID maps to the open CVEs on your assets (ATT&CK 16.1 Enterprise, CISA KEV catalogue as of 28 July 2025); a CVE outside that set appears unmapped. It is context, not detection: it does not identify attacks or map your incidents to techniques.
What does it need to work?
The assets in your inventory, with their vendors. What is not in the inventory does not appear in «My exposure».
Does it alert me when a new CVE comes out?
The radar does not raise alerts of its own: it is a view for prioritising whom to ask first.
See which CVEs touch your inventory
Request a demo and, with sample data, we match the CVEs of an asset with the vendors that own it.
Daily sync; no sector threat intelligence sources.