We evaluate both new and existing vulnerabilities based on factors like:

• threat scores (e.g. EPSS, CVSS)
• trending evidence
• exploitation evidence

We then generate a score using our proprietary algorithm, and assign a risk rating to each vulnerability:

Significant risk and threat activity identified for this CVE. This CVE is likely tagged prominently in the news, has active exploits and multiple POCs.

High risk and threat activity identified for this CVE.

Elevated risk and threat activity identified for this CVE.

Moderate risk and threat activity identified for this CVE.

Low risk and threat activity identified for this CVE. This CVE likely has no associated exploits or POCs, and is likely to have very few mentions across news or social media.