Every CVE arrives scored, owned, and on a clock.

It is the process of matching the exact software versions installed on a device against a database of known vulnerabilities (CVEs), so that instead of a generic advisory feed you get a precise list of which of your devices are actually affected by which vulnerability. Secuno does this automatically for every managed device, several times a day.

Every correlated CVE is scored by its EPSS exploit probability, flagged if CISA lists it as actively exploited (KEV), and checked for public exploit availability. On top of that, Secuno works out whether an attacker can actually reach the affected path on that specific device, and whether your existing controls block that path. A critical CVE in a service bound to loopback is not the same finding as the same CVE on an internet-facing host, and the queue reflects that.

No. Scoring runs on SECAI, Secuno's own inference engine, on our infrastructure in the Netherlands. No CVE data, device inventory or risk detail is sent to a third-party model provider.

New CVEs arrive from CVE.org every hour, and the CISA KEV and NVD feeds synchronise four times a day. A CVE newly added to KEV does not wait for the next sweep: it triggers a targeted correlation at once, affected clients get a critical notification and an email, and each affected risk escalates with its SLA clock reset.

Every correlation finding is graded on how certain the match is, and the cuts were calibrated against a full production set of findings rather than picked by feel. Confident matches are accepted automatically, borderline ones are shown and flagged for a human decision, and matches we do not believe are dropped to informational and kept out of the default queue. They are not deleted and stay retrievable. A version the engine cannot read with confidence, such as a packaging tag glued to a version number, ends the comparison and keeps the CVE out rather than asserting a match. One deliberate exception: a CVE listed as actively exploited or with a high EPSS score is never hidden, at worst it lands in the review queue. A suppressed false positive costs an analyst nothing; a suppressed known-exploited CVE is the one mistake you cannot recover from.

Yes. The classic Linux false positive comes from distributions backporting a security fix without changing the upstream version number, so a package matched against NVD looks vulnerable on a fully patched host. Secuno does not match Linux packages against NVD. It reads the distributions' own advisories through OSV (Ubuntu, Debian, Alpine, Rocky Linux, AlmaLinux and openSUSE) for the packages your fleet actually runs, and compares versions the way that distribution's package manager does. A host one update behind matches; the same host after the update does not.

Yes, through device groups. A group can carry adjustments from a fixed list of reasons: not reachable over the network, on an isolated or test segment, no sensitive data, being decommissioned, internet facing, sensitive or regulated data, business critical, legacy or cannot be patched, shared or kiosk device, or a reason in your own words. Each adjustment is bounded, a reason counts once however many groups repeat it, and the rule that context can move a finding at most one severity band still applies first, so a group can reorder findings but never turn an informational note into a critical one. The risk page lists these adjustments separately from the measured controls, because they are an operator's statement rather than a measurement. A group can also declare that membership is itself a finding, for example devices on an unsupported operating system.

Yes, and this changed recently. Findings from custom rules, Microsoft 365 posture, agent change events and manual entry are the majority of what an operator actually opens, and they used to arrive with no score and no explanation because both required a CVE. The source now declares a severity band, scoring ranks within that band, and the same plain-English explanation panel is filled in for them. Findings that predate this are backfilled rather than left blank.