Exposure & vulnerabilities

Exposure answers a focused question: across everything your fleet has installed, what carries known vulnerabilities, what is being actively exploited, and how many endpoints are affected?

How vulnerabilities are found

Package artifacts are checked against OSV (which aggregates GHSA and CVE/NVD) on every agent report. Cernexa also pulls in:

• CISA KEV — whether a CVE is on the Known Exploited Vulnerabilities list.
• EPSS — the Exploit Prediction Scoring System probability that a CVE will be exploited.
• Ransomware association — whether a known-exploited CVE is tied to ransomware campaigns.

The Exposure page

Alerts surface newly-discovered vulnerabilities. Each alert names the software, the CVE IDs added, the maximum severity, whether it's exploited in the wild, the number of endpoints affected, and when it was raised. Acknowledge an alert to clear it once you've triaged it.

The vulnerable software table lists every affected artifact:

• Software and type — links to the artifact detail.
• Severity — the worst CVE in the installed version, with a KEV or RANSOMWARE flag when actively exploited.
• EPSS — exploitation probability.
• CVEs — count of known vulnerabilities.
• Endpoints — how many devices run the vulnerable version.
• Verdict — the artifact's overall Crucible verdict.

If nothing is affected, you'll see a clean state confirming that package artifacts are being checked against OSV on every report.

Turning exposure into action

• Prioritize by exploitation, not just severity. A medium CVE on the KEV list with high EPSS is more urgent than an unexploited critical.
• Auto-quarantine the worst. In Governance, enable auto-quarantine so actively-exploited (KEV) or critical-CVE software is contained automatically — even under a permissive policy.
• Block at the door. Use the Supply Chain Gateway to stop vulnerable versions from being installed in CI.

Related

• Discovery & the Crucible score
• Governance & enforcement posture