CPE matching against live inventory
Every device the agent reports carries an installed-software inventory: product name, vendor, and exact version. Secuno normalises each entry into a CPE (Common Platform Enumeration) identifier and matches it against the CPE configurations attached to each CVE in the NIST NVD.
Because the inventory is refreshed on every agent run, a match reflects what is installed right now. When software is patched or removed, the next inventory clears the match and the associated risk resolves automatically.
Version range parsing
A CVE rarely affects a single version. NVD expresses affected ranges with constraints such as versionStartIncluding and versionEndExcluding. Secuno parses these ranges and compares the installed version against them using semantic version ordering, not string comparison.
This avoids the classic false positive where 1.10 is treated as lower than 1.9. It also avoids false negatives where a vulnerable build inside a range is missed because only the boundary versions were checked.
A version the engine cannot read with confidence, such as a packaging tag glued to the version number, ends the comparison and keeps the CVE out rather than asserting a match. Linux distribution packages are not compared against NVD ranges at all, because distributions backport fixes without changing the upstream version. They are checked against the distributions' own advisories (Ubuntu, Debian, Alpine, Rocky Linux, AlmaLinux and openSUSE, read through OSV) using that package manager's own version ordering, so a patched host is recognised as patched.
NIST NVD and CISA KEV deduplication
Secuno ingests both the NIST NVD and the CISA Known Exploited Vulnerabilities catalogue. The same CVE appears in both. Secuno keys on the CVE identifier and merges the records into a single correlated entry, so a device is never flagged twice for one vulnerability.
When a CVE is present in the KEV catalogue, the merged entry carries that flag and is escalated. New CVEs arrive from CVE.org every hour, NVD enrichment and the KEV catalogue synchronise four times per day, and a new KEV listing triggers an immediate re-evaluation rather than waiting for the next scheduled cycle.
What makes the match specific
Generic scanners often match on product name alone and leave version disambiguation to the analyst. Secuno requires a vendor, product, and version match before it raises a vulnerability risk, and it records the exact CPE and version range that produced the match in the risk detail.
That provenance means every correlated risk is auditable. An analyst can see precisely why a CVE was attached to a device, which keeps remediation focused on confirmed exposure rather than probable exposure.