Introduction

VulnCheck Exploit & Vulnerability Intelligence replaces the need to correlate vulnerability intelligence across hundreds of sources such as the NIST National Vulnerability Database (NVD), CVElist, the CISA KEV catalog, etc. By integrating with VulnCheck Exploit & Vulnerability Intelligence, you're integrating with an Open Source Intelligence (OSINT) product that has best-in-class information, in a timely manner, on vulnerability exploitation and vulnerabilities generally.

Unlike alternative vulnerability intelligence approaches, the VulnCheck platform and VulnCheck Exploit & Vulnerability Intelligence product is built from a fully autonomous system in software.

Organizations leverage VulnCheck Exploit & Vulnerability Intelligence to make better decisions on which vulnerabilities need immediate remediation.

Unlike other vulnerability databases, VulnCheck includes the latest information on a wider range of vulnerabilities, including:

• Vulnerabilities in Open Source packages / dependencies
• Vulnerabilities in ICS/OT, IoMT, IoT, mobile, etc., devices

Most importantly, unlike other purely vulnerability-centric solutions, VulnCheck marries exploit intelligence with vulnerability intelligence. By coupling exploit intelligence with vulnerability intelligence, better insights into vulnerability prioritization & remediation can be gained.

VulnCheck Exploit Intelligence

VulnCheck Exploit Intelligence includes a wide range of features designed to help understand the state of vulnerability exploitation. Such features include, but are not limited to:

• Monitoring of Git repositories, blog posts and other sources for new exploit PoCs
• Review and validation of exploit PoCs
• Caching of exploit PoCs
• Exploit Maturity classification
• Exploit Type classification
• Evidence of exploitation in-the-wild
• Exploit/Exploitation timelines
• Ransomware families, threat actor, botnet, and exploit counts

VulnCheck Vulnerability Intelligence

VulnCheck Vulnerability Intelligence includes unique intelligence and enrichment, typically unavailable in other alternative sources, such as:

• Categorization (e.g., ICS/OT, IoMT, IoT, Mobile, Server Software, etc.)
• Faster & Cleaner Common Platform Enumeration(CPE)
• CVSS Temporal Enrichment (CVSS-BT) / CVSS V4 Enrichment
• MITRE ATT&CK mapping
• MITRE Attack Patterns (CAPEC) mapping
• CWE associations for pre-2008 CVEs
• More vendor advisory references
• More vulnerability database references
• More exploit references
• EPSS Enrichment
• Ability to query by Package URL (purl)
• Vulnerability Status
• Less broken links