Every new CVE, matched to your hosts and proven
cvENGINE finds everything you expose on the internet, watches the CVE feeds around the clock, and proves which new vulnerabilities actually reach you. We run it for you on a server and a scanner that belong to you alone: $7,500 a year for up to 3,000 IP addresses.
New on the CVE wire
Apache Tomcat AJP file read (Ghostcat)
2 hosts run Tomcat 9.0.30
Apache Log4j remote code execution
1 host runs an affected Log4j
Confluence broken access control
1 host runs Confluence 8.3
OpenSSH signal handler race (regreSSHion)
1 host runs OpenSSH 9.6
Runs the scanners security teams already trust
- Nuclei
- Nmap
- naabu
- bbot
- testssl.sh
- WPScan
- Kingfisher
- OpenVAS
The CVE lands at night. The question lands at nine
"Are we affected?" Without an answer ready, that question costs your team a day. With cvENGINE it is answered before anyone asks.
Without cvENGINE
- Leadership forwards the headline and asks if you are exposed.
- Someone exports last quarter's asset spreadsheet and hopes it is current.
- Version checks start by hand, host by host, on the hosts you remember.
- "Probably not affected." Nobody can say how sure that is.
With cvENGINE
- The CVE arrives on the feed and is matched to every host running the affected version.
- Your Sentinel runs a read-only check against each match and keeps the evidence.
- You forward a list: these hosts are affected, here is the proof, here is the fix.
From advisory to evidence, on its own
Five steps run continuously for every host you own, and you open the results. The screens below use example data.
Watch the feeds
cve.now every 30 minutes, with CISA KEV, VulnCheck KEV, ENISA EUVD, FIRST EPSS, Exploit-DB and Metasploit every hour. A CVE that starts being exploited moves up the list the hour it happens.
Find who is exposed
Every CVE is matched to the hosts running the affected product and version, from fingerprints of all 65,535 TCP ports on every address you own.
Write the check
When no vetted check exists, your AI drafts a read-only one. cvENGINE validates it against a safe target before it ever touches your hosts.
id: cve-2020-1938-ajp-read
info:
severity: critical
tags: cve,tomcat,ajp,read-only
tcp:
- host: "{{Hostname}}:8009"
matchers: [ ajp-file-read ]Prove it on your hosts
Your Sentinel runs the check and keeps the evidence. A version match becomes a fact you can hand to the owner of the host.
Cut the noise
AI reviews the evidence, so what is real rises and likely false positives sink. It never closes a finding that a check proved.
See your estate the way an attacker does
Constellations, not spreadsheets
Every domain is drawn as a constellation of its hosts, sized by how many there are, with flares where something is wrong. Double-click one and every host in it opens up.
Search your estate like Shodan
Ask questions of everything cvENGINE found, in the terms you already use on the open internet.
tech:phpevery PHP host
port:3389 -host:vpnRDP off the VPN
tech:"apache tomcat" sev:highTomcat with a high finding
Heat that means something
Findings are ranked by evidence, so the top of the list is the work that matters today.
Your own cvENGINE, not a slice of someone else's
Every customer gets a dedicated server and a dedicated scanner. That changes what you can promise your auditors and your board.
Your data stays in your database
Your inventory, findings and evidence live on a cvENGINE server that runs for you alone, with its own database. Nothing is pooled with other customers.
A scanner of your own
Your Sentinel scans only your estate, so you always know which traffic is yours. Add more Sentinels inside your offices, VPCs or VPNs to assess internal hosts too.
Open source you can read
The cvENGINE you rent is the same code that is public on GitHub under GPL-3.0. Read every check before it runs, and if you outgrow us, run it yourself.
A price on the page
One plan, $7,500 a year for up to 3,000 IP addresses. No demo call to find out what it costs, and no per-scan meter.
One plan for your whole external surface
Hosted cvENGINE
Up to 3,000 IP addresses. That is $2.50 per address for a year of continuous discovery, matching and proof.
- A dedicated cvENGINE server, not shared with anyone
- A dedicated Sentinel for discovery, port sweeps and checks
- Every release installed for you
- Extra Sentinels inside your own networks
- Your choice of AI: Anthropic, OpenAI, OpenRouter or a local model, or none at all
- REST API and an MCP server for your own tools and agents
Rather run it yourself?
cvENGINE is open source. The same software runs on your own hardware with Docker Compose, free under GPL-3.0. Hosted is for teams who would rather spend their time on findings than on servers.
Get early access
We are setting up the first teams by hand. Leave your details and we will be in touch.
We talk
About your domains, roughly how many addresses you have, and where your internal networks are.
You prove ownership
A DNS record on each domain. cvENGINE scans only what you show you own.
Your instance comes up
Your server and Sentinel start, discovery begins, and a sign-in link arrives by email.
Questions, answered
Do I need an AI model?
No. cvENGINE discovers, scans, matches and validates without one. AI is off until you switch it on, with your own key for Anthropic, OpenAI or OpenRouter, or a local model you run.
What will you scan?
Only domains and addresses you prove you own, from your own Sentinel. The checks are read-only: no exploit payloads, no password lists, nothing that changes a host.
Can AI close a finding on its own?
It reviews the evidence and ranks findings, and the server checks every answer. It never closes a finding that a check proved.
Can you scan my internal networks?
Yes, with a Sentinel you run inside that network. It connects out to your cvENGINE, so nothing on your network has to accept an inbound connection.
Is my data mixed with other customers'?
No. Each customer has a separate cvENGINE server with its own database, and a separate Sentinel.
What if I have more than 3,000 addresses?
Choose "More than 3,000" when you request early access and we will size a plan with you.