Vulnerability model

A vulnerability is a known flaw in software or firmware. A CVE (Common Vulnerabilities and Exposures) number identifies each vulnerability.

The platform matches resources to CVEs based on the vendor, product, and firmware version extracted during discovery. The quality of the match depends on the detail the enrichment pipeline was able to extract for each resource.

Vulnerability data comes from four feeds that the platform pulls automatically. The NVD (National Vulnerability Database) serves as the primary source of CVE records and includes CVSS severity scores. The CISA KEV (Known Exploited Vulnerabilities) provides a curated list of CVEs actively being exploited in the wild. The EPSS (Exploit Prediction Scoring System) provides a probability score estimating how likely a CVE is to be exploited in the next 30 days. Siemens CSAF (Common Security Advisory Framework) provides vendor-specific advisories covering their industrial product lines.

Severity is based on the CVSS score. Severity is categorized as Critical, High, Medium, or Low.

EPSS and CISA KEV data help you prioritize beyond raw severity. A medium-severity CVE that is actively exploited (KEV) or has a high exploitation probability (EPSS) may deserve attention before a critical-severity CVE with no known exploits.

Matches can be imprecise. If the sensor could not extract a precise firmware version, the match is broader and may include CVEs that do not actually apply. Improve discovery data by enabling vendor-specific enrichment or providing credentials. This tightens the matches.