Request demo

Vulnerability Management

Rank Vulnerabilities by Real-World Exploitation.

A queue sorted by CVSS alone treats every critical the same, whether or not anyone is exploiting it.

External Attack Surface Management finds the CVEs on your internet-facing assets and ranks each one by CVSS, EPSS and CISA KEV together. Then it tracks each finding until a rescan confirms the fix.

Request demoPlatform guide: Vulnerability list

issueCVE-2021-41773 on staging.acme.example

  1. newly_detected

    2026-09-24 · web data: Apache httpd 2.4.49 · cpe:2.3:a:apache:http_server:2.4.49

  2. unresolved

    CVSS 9.8 · Critical · in CISA KEV → first in the queue

    • owner: web platform team

  3. marked_as_resolved

    the web platform team marks the fix

  4. verified_resolved

    the rescan confirms the fix · 2.4.49 no longer found

The Questions to Ask of Every CVE.

CVSS answers how bad. EPSS and CISA KEV answer the questions it leaves open.

How bad

CVSS

Severity if exploited. The Deepinfo Platform keeps CVSS v2, v3.0, v3.1 and v4.0 metrics where published, plus vDeep, Deepinfo’s own CVSS scoring layer.

How likely

EPSS

The Exploit Prediction Scoring System’s probability that the CVE is exploited in the next 30 days, with its percentile and its history.

Already happening

CISA KEV

Whether CISA lists the CVE as exploited in the wild, with the date added, the due date, the required action and known ransomware campaign use.

The Queue Starts at the Top.

Rank findings by CVSS, EPSS and CISA KEV together and the ones worth an emergency change separate from the rest. Anything CISA KEV lists moves up, wherever its CVSS falls.

A high CVSS with a negligible EPSS and no KEV listing waits for the normal patch cycle.

CVE on one of your assets

Fix first listed in CISA KEV, known to be exploited

  1. CVE-2021-44228

    10.0

    EPSS 0.99999 CISA KEV

    Critical

  2. CVE-2021-41773

    9.8

    CISA KEV

    Critical

The normal patch cycle EPSS low, not in CISA KEV

  1. a CVE

    9.8

    EPSS low

    Critical

  2. a CVE

    5.3

    EPSS low

    Medium

CVSS alone cannot tell the two 9.8s apart. CISA KEV and EPSS can.

Detection and Context Close the Loop.

Detection and the queue live in External Attack Surface Management. Deep Search & Insights holds the full CVE record, and Cyber Threat Intelligence adds who is using it.

Risk Detection

Fingerprints the technologies on each asset with their versions, matches them to the CVEs that affect them and flags products past end of life.

EASM

Risk Scoring

Ranks each CVE by CVSS, EPSS and CISA KEV, and rolls issues up into scores per asset, per domain and for the whole surface.

EASM

Remediation

Works each finding through its states. A fix marked resolved becomes verified resolved only when a rescan no longer finds it.

EASM

Vulnerability Intelligence

Opens the full CVE record: CWE with CAPEC and OWASP Top 10 2021, affected products as CPE ranges, and EPSS history.

DSI

Threat Actor Intelligence

Shows which tracked threat actors list a CVE among the ones they use, next to the industries and countries they target.

CTI

How a CVE Reaches Its Owner.

  1. 01

    Fingerprint

    Each scan reads the technologies on each monitored asset from the web data layer, with versions and CPE names.

  2. 02

    Match

    Technologies are matched to the CVEs that affect their versions. A new match raises new_vulnerability_detected.

  3. 03

    Rank

    KEV-listed and high-EPSS CVEs on exposed assets go to the top. An asset weight marks the systems that matter most.

  4. 04

    Assign

    Tag assets by owner and route new and reappeared vulnerabilities to them, instantly or as a digest.

  5. 05

    Verify

    When the owner marks a fix, the next scan checks it. A CVE that comes back is raised again as reappeared.

Put the Question to the Whole CVE Database.

The CVE database behind the platform is searchable on its full record, including the EPSS and CISA KEV enrichment. This request asks for known-exploited CVEs with an EPSS score of 0.7 or higher.

POST https://api.deepinfo.com/v1/discovery/vulnerability-search Reference

Request

curl 
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "enrichment.cisa_kev.date_added", "type": "exists", "value": true },
        { "name": "enrichment.epss_score.epss", "type": "gte", "value": 0.7 }
      ]
    },
    "sort": [{ "field": "published", "order": "desc" }]
  }'

Response

200 OK · application/json 
{
  "page": 1,
  "page_size": 25,
  "result_count": "…",
  "results": [
    "…",
    {
      "id": "CVE-2021-44228",
      "published": "2021-12-10T10:15:09Z",
      "cisa_exploit_add": "2021-12-10",
      "cisa_action_due": "2021-12-24",
      "enrichment": {
        "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
        "cisa_kev": { "product": "Log4j2", "date_added": "2021-12-10", "…": "…" },
        "…": "…"
      },
      "…": "metrics, weaknesses, descriptions, references"
    },
    "…"
  ]
}

Field names are from the Vulnerability Search reference. Set the EPSS threshold to match your patching policy.

Before and After the Queue.

Use case Attack Surface Management The assets have to be in scope before their CVEs can be ranked. Read Use case Ransomware Exposure Monitoring Known exploited CVEs are one of the ways ransomware gets in. Read EASM Risk Scoring How CVSS, EPSS and CISA KEV combine into scores per asset, per domain and for the whole surface. Read

Use This Data in Your Tools

The vulnerability data the platform prioritizes with, CVSS, EPSS and CISA KEV for every CVE, is open through the API.

Questions About Vulnerability Management

How are vulnerabilities detected on our assets?

By fingerprinting the technologies each asset serves, with their versions, and matching them to the CVEs that affect those versions through their CPE names. End-of-life status is checked on the same data.

Does this replace our internal vulnerability scanner?

The two cover different ground. An internal scanner sees hosts inside your network. The platform sees what the internet sees, including assets missing from the scanner’s target list.

What is EPSS?

The Exploit Prediction Scoring System, maintained by FIRST, estimates the probability that a CVE will be exploited in the next 30 days. The platform stores the score with its percentile and keeps its history for each CVE.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog, published by the US Cybersecurity and Infrastructure Security Agency, lists CVEs with evidence of exploitation in the wild. For each listed CVE the platform records the date added, the due date, the required action and known ransomware campaign use.

Does the platform try to exploit the CVEs it finds?

No. It matches the technologies it detects to known CVEs and makes no exploit attempts, and standard monitoring runs no authenticated scans or load tests either.

What if a finding is a false positive?

Mark it as one. The finding leaves the active queue but keeps its state history, and a revert puts it back if the call was wrong.

Why do some new CVEs have no CVSS score yet?

A CVE record can be published before its CVSS metrics, EPSS score or CWE classification are attached, and those fill in as the record is analyzed. The record’s status shows how far analysis has gone.

Can we check CVEs for software we don’t expose?

Yes. Vulnerability Search queries the CVE database directly, affected products included, with no asset involved, which suits software that runs only inside your network.

Rank Your CVEs by Exploitation Signal.

Book a demo and walk through the ranked queue for your assets with our team.

Request demo