# Vulnerability Management

URL: https://www.deepinfo.com/solutions/use-cases/vulnerability-management/

## Rank Vulnerabilities by Real-World Exploitation.

A queue sorted by CVSS alone treats every critical the same, whether or not anyone is exploiting it.

[External Attack Surface Management](https://www.deepinfo.com/platform/easm/) finds the CVEs on your internet-facing assets and ranks each one by CVSS, EPSS and CISA KEV together. Then it tracks each finding until a rescan confirms the fix.

[Request demo](https://www.deepinfo.com/request-demo/) · [Platform guide: Vulnerability list](https://docs.deepinfo.com/guide/easm/vulnerabilities/)

### The Questions to Ask of Every CVE.

CVSS answers how bad. EPSS and CISA KEV answer the questions it leaves open.

How bad

#### CVSS

Severity if exploited. The Deepinfo Platform keeps CVSS v2, v3.0, v3.1 and v4.0 metrics where published, plus vDeep, Deepinfo’s own CVSS scoring layer.

How likely

#### EPSS

The Exploit Prediction Scoring System’s probability that the CVE is exploited in the next 30 days, with its percentile and its history.

Already happening

#### CISA KEV

Whether CISA lists the CVE as exploited in the wild, with the date added, the due date, the required action and known ransomware campaign use.

### The Queue Starts at the Top.

Rank findings by CVSS, EPSS and CISA KEV together and the ones worth an emergency change separate from the rest. Anything CISA KEV lists moves up, wherever its CVSS falls.

A high CVSS with a negligible EPSS and no KEV listing waits for the normal patch cycle.

### Detection and Context Close the Loop.

Detection and the queue live in External Attack Surface Management. [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/) holds the full CVE record, and [Cyber Threat Intelligence](https://www.deepinfo.com/platform/cti/) adds who is using it.

#### [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/)

Fingerprints the technologies on each asset with their versions, matches them to the CVEs that affect them and flags products past end of life.

#### [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/)

Ranks each CVE by CVSS, EPSS and CISA KEV, and rolls issues up into scores per asset, per domain and for the whole surface.

#### [Remediation](https://www.deepinfo.com/platform/easm/remediation-with-actionable-insights/)

Works each finding through its states. A fix marked resolved becomes verified resolved only when a rescan no longer finds it.

#### [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/)

Opens the full CVE record: CWE with CAPEC and OWASP Top 10 2021, affected products as CPE ranges, and EPSS history.

#### [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/)

Shows which tracked threat actors list a CVE among the ones they use, next to the industries and countries they target.

### How a CVE Reaches Its Owner.

1. **Fingerprint**

   Each scan reads the technologies on each monitored asset from the web data layer, with versions and CPE names.
2. **Match**

   Technologies are matched to the CVEs that affect their versions. A new match raises `new_vulnerability_detected`.
3. **Rank**

   KEV-listed and high-EPSS CVEs on exposed assets go to the top. An asset weight marks the systems that matter most.
4. **Assign**

   Tag assets by owner and route new and reappeared vulnerabilities to them, instantly or as a digest.
5. **Verify**

   When the owner marks a fix, the next scan checks it. A CVE that comes back is raised again as reappeared.

### Put the Question to the Whole CVE Database.

The CVE database behind the platform is searchable on its full record, including the EPSS and CISA KEV enrichment. This request asks for known-exploited CVEs with an EPSS score of 0.7 or higher.

POST `https://api.deepinfo.com/v1/discovery/vulnerability-search` [Reference](https://docs.deepinfo.com/reference/vulnerability/search/)

Request

curl

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "enrichment.cisa_kev.date_added", "type": "exists", "value": true },
        { "name": "enrichment.epss_score.epss", "type": "gte", "value": 0.7 }
      ]
    },
    "sort": [{ "field": "published", "order": "desc" }]
  }'
```

Response

200 OK · application/json

```json
{
  "page": 1,
  "page_size": 25,
  "result_count": "…",
  "results": [
    "…",
    {
      "id": "CVE-2021-44228",
      "published": "2021-12-10T10:15:09Z",
      "cisa_exploit_add": "2021-12-10",
      "cisa_action_due": "2021-12-24",
      "enrichment": {
        "epss_score": { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
        "cisa_kev": { "product": "Log4j2", "date_added": "2021-12-10", "…": "…" },
        "…": "…"
      },
      "…": "metrics, weaknesses, descriptions, references"
    },
    "…"
  ]
}
```

Field names are from the Vulnerability Search reference. Set the EPSS threshold to match your patching policy.

### Before and After the Queue.

- [Attack Surface Management](https://www.deepinfo.com/solutions/use-cases/attack-surface-management/) (Use case): The assets have to be in scope before their CVEs can be ranked.
- [Ransomware Exposure Monitoring](https://www.deepinfo.com/solutions/use-cases/ransomware-exposure-monitoring/) (Use case): Known exploited CVEs are one of the ways ransomware gets in.
- [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) (EASM): How CVSS, EPSS and CISA KEV combine into scores per asset, per domain and for the whole surface.

### Use This Data in Your Tools

The vulnerability data the platform prioritizes with, CVSS, EPSS and CISA KEV for every CVE, is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Finder API](https://www.deepinfo.com/data-api/apis/vulnerability-finder/)
- [Technology Lookup API](https://www.deepinfo.com/data-api/apis/technology-lookup/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)

### Questions About Vulnerability Management

**How are vulnerabilities detected on our assets?**

By fingerprinting the technologies each asset serves, with their versions, and matching them to the CVEs that affect those versions through their CPE names. End-of-life status is checked on the same data.

**Does this replace our internal vulnerability scanner?**

The two cover different ground. An internal scanner sees hosts inside your network. The platform sees what the internet sees, including assets missing from the scanner’s target list.

**What is EPSS?**

The Exploit Prediction Scoring System, maintained by FIRST, estimates the probability that a CVE will be exploited in the next 30 days. The platform stores the score with its percentile and keeps its history for each CVE.

**What is CISA KEV?**

The Known Exploited Vulnerabilities catalog, published by the US Cybersecurity and Infrastructure Security Agency, lists CVEs with evidence of exploitation in the wild. For each listed CVE the platform records the date added, the due date, the required action and known ransomware campaign use.

**Does the platform try to exploit the CVEs it finds?**

No. It matches the technologies it detects to known CVEs and makes no exploit attempts, and standard monitoring runs no authenticated scans or load tests either.

**What if a finding is a false positive?**

Mark it as one. The finding leaves the active queue but keeps its state history, and a revert puts it back if the call was wrong.

**Why do some new CVEs have no CVSS score yet?**

A CVE record can be published before its CVSS metrics, EPSS score or CWE classification are attached, and those fill in as the record is analyzed. The record’s `status` shows how far analysis has gone.

**Can we check CVEs for software we don’t expose?**

Yes. [Vulnerability Search](https://www.deepinfo.com/platform/dsi/vulnerability-search/) queries the CVE database directly, affected products included, with no asset involved, which suits software that runs only inside your network.

### Rank Your CVEs by Exploitation Signal.

Book a demo and walk through the ranked queue for your assets with our team.

[Request demo](https://www.deepinfo.com/request-demo/)