Threat Exposure
What it is
Threat Exposure enriches each CVE with real-world attack context. A vulnerability's CVSS score alone does not tell you whether attackers are actively exploiting it. This module answers: Is this being exploited? By whom? With what tools?
Highlights
- Exploit intelligence — aggregates proof-of-concept code, public exploits, and weaponized exploit modules from GitHub, Exploit-DB, Metasploit, and Nuclei.
- CISA KEV integration — flags vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog.
- EPSS scoring — includes Exploit Prediction Scoring System probability and percentile.
- Threat actor and ransomware context — links CVEs to known campaigns and ransomware families when available.
- Exploit maturity levels — classifies findings from none → proof-of-concept → public exploit → verified weaponized/RCE.
- Advisory aggregation — pulls advisories from OSV, CERT-EU, CERT-CC, PacketStorm, and related sources.
- Feeds the SC5 score — threat exposure data is the primary input for scani5 's prioritized risk scoring.
- Visibility Index (CVERadar) — tracks real-time public discussion of CVEs across GitHub, GitLab, Reddit, HackerNews, and Twitter/X — see Visibility Index.
Key concepts
| Concept | Meaning |
|---|---|
| Public exploit | Community-shared exploit artifacts (e.g., GitHub PoCs) |
| Validated exploit | Confirmed exploit evidence from trusted sources |
| Weaponized exploit | Ready-to-use exploit modules (e.g., Metasploit, Nuclei) |
| KEV | CVE confirmed as actively exploited per CISA |
| EPSS | Statistical probability that a CVE will be exploited in the wild |
In the application
Threat exposure context appears in vulnerability details, the Dashboard Active Exploits section, and feeds into SC5 Risk Score prioritization.