Request demo

Risk Detection

Misconfigurations, Exposures and CVEs Land in One Feed.

Risk on an attack surface rarely arrives labeled as a CVE. It is a certificate that lapsed on a payment page, a database port answering on a public IP, a login page nobody meant to publish, or a framework past its end of life.

The Deepinfo Platform reads each layer of the assets it monitors and raises what it finds as issues with a severity and stored evidence, right next to the CVEs found on those assets.

Request demoPlatform guide: Issue list

Scanall checked

staging.acme.example 203.0.113.7

  1. WHOISwhois

    no issue

  2. IP WHOISipwhois

    no issue

  3. DNSdns

    no issue

  4. SSLssl

    certificate expired · payment page

    High

  5. Portsport_scan

    5432/tcp · database answering on a public IP

    Critical

  6. Web datawebdata

    login page · PHP 7.4 end of life · Apache httpd 2.4.49

    High

  7. HTTPhttp

    no issue

Feed · sorted by severity
  1. Critical CVE-2021-41773 · matched by CPE CVSS 9.8 · KEV Vulnerability
  2. Critical Database port on a public IP Exposure
  3. High Expired certificate on a payment page Configuration
  4. High PHP 7.4 end of life Vulnerability
  5. Medium Login page published Exposure

Each Kind of Risk Shares One Set of Actions.

Configuration and exposure checks raise issues, and known CVEs are tracked as vulnerabilities on each affected asset. Both carry a severity and are worked with these actions: resolve, accept the risk, ignore, mark as false positive or revert.

Configuration

Settings That Weaken an Asset

DNS misconfigurations, weak TLS settings, missing security headers, and certificates that are expired, expiring, self-signed on a public host or on a chain that does not validate. Read from the DNS, SSL and HTTP layers.

Exposure

Services That Should Not Be Public

Remote access, database and file-sharing ports answering on public IP addresses, and admin panels and sign-in pages reachable from the internet. The web data layer scores how likely each page is to be a login page.

Vulnerability

Software With Known Flaws

Technologies fingerprinted with their versions, matched to the CVEs that affect them, including those CISA KEV lists as exploited in the wild, and checked against the product’s end-of-life status.

Every CVE Arrives With Its Full Record.

A CVE ID alone tells your team very little. Each one found on your assets carries the context needed to decide what happens next.

Severity comes as CVSS v2, v3.0, v3.1 and v4.0 metrics where published, plus vDeep, Deepinfo’s own CVSS scoring layer. Likelihood comes from EPSS, and confirmation from CISA’s Known Exploited Vulnerabilities catalog, with its due date and required action.

Each CVE is mapped to its CWE weaknesses, with their CAPEC attack patterns and OWASP Top 10 2021 category. The Vulnerability Detail API returns this enrichment for any CVE.

Vulnerability Detail API
CVE-2021-44228 
{
  "id": "CVE-2021-44228",
  "cisa_exploit_add": "2021-12-10",
  "cisa_action_due": "2021-12-24",
  "metrics": {
    "cvss_metric_v31": [
      { "cvss_data": { "version": "3.1", "base_score": 10.0 } }
    ],
    "cvss_metric_v40": ["…"],
    "cvss_metric_v30": ["…"],
    "cvss_metric_v2": ["…"]
  },
  "enrichment": {
    "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    "cisa_kev": {
      "product": "Log4j2",
      "date_added": "2021-12-10",
      "required_action": "…",
      "known_ransomware_campaign_use": "…"
    },
    "cwe": [
      { "id": 400, "capec_id": [147, 227], "owasptop10_2021": null }
    ],
    "vdeep_metric": { "cvss_data": { "…": "…" } }
  }
}
  1. How severe
  2. How likely to be exploited
  3. Known to be exploited
  4. What kind of flaw
  5. Deepinfo’s own scoring

Know When a Version Stops Getting Fixes.

A technology with no open CVE today can still be a liability, because once a product reaches end of life the next flaw will not be patched. The platform checks detected products against their end-of-life status and ranks the most vulnerable technologies across your assets.

Each technology record lists its versions and the assets that run it, so an upgrade plan starts from the exact list of hosts.

Technology End Of Life Status reference

End-of-life status

PHP 7.4

/v1/easm/technologies/eol/php

  • end of life
  • High PHP 7.4 end of life still in use today
Assets that run it
  • staging.acme.example
End-of-life status 
# End-of-life status for one product
curl "https://api.deepinfo.com/v1/easm/technologies/eol/php" \
  -H "apikey: YOUR_API_KEY"

PCI DSS 4.0 findings are one filter away.

Each issue carries its classifications under OWASP Top 10 2021, PCI DSS 4.0, PCI DSS 3.2, HIPAA, CWE, CAPEC and WASC.

Filter the issue search by one framework and export the result as CSV or JSON for the auditor.

Detection Sits in the Middle.

EASM Continuous Scanning The scanned layers that detection reads from. Read EASM Remediation What happens to an issue after it is raised. Read EASM Risk Scoring Scores per asset and domain, and how CVEs are ranked. Read

Questions About Risk Detection

How is this different from a vulnerability scan?

A vulnerability scan checks the hosts you point it at for CVEs. Detection here starts from the inventory that discovery builds, and it raises configuration and exposure problems as issues next to the CVEs on the same assets, so an expired certificate or an open database port does not get lost for lack of a CVE ID.

How are technologies matched to CVEs?

The web data layer fingerprints the technologies on each asset, with their versions. Each technology is identified by its CPE name and matched to the CVEs whose affected-product ranges include that product and version.

Can a CVE match be wrong?

Sometimes. CVEs are matched to the version a host reports, and a vendor backport can fix a flaw without changing that version. Mark such a finding as a false positive and the decision stays on record.

Which severities does the platform use?

Critical, High, Medium, Low and Information. Vulnerabilities also carry CVSS, EPSS and CISA KEV, which Risk Scoring uses to rank them.

Do findings without a CVE count toward the score?

Yes. The security score is built from the issues and the vulnerabilities found on an asset, so configuration and exposure issues count toward it as well.

How do we hear about new findings?

Through notification rules on new issues and new vulnerabilities, narrowed by asset, severity or tag if you like, and delivered instantly or as an hourly to monthly digest.

See Which Risks Sit on Your Assets.

Book a walk-through of the full feed with our team.

Request demo