Vulnerability BI — sidebar hides with the toggle
Sign in

Executive Summary

A leadership summary built only from the metrics on this page: what is confirmed, what is still unvalidated, and what the data cannot say.

Mode: Global CVE catalogue
0 CVEs in scope
My environment
Supports action
Patch now

Current, non-demo canonical findings for the active organisation and scan scope. Every row is backed by evidence collected from your own assets.

Every sentence below restates a metric shown on this page for the last 12 months.

Data sources, exact rule, and what is unknown

Powered by: public.canonical_findings via listCanonicalFindings · public.canonical_finding_remediations for open work · public.cves via fetchCves for severity, EPSS and KEV

Rule: Every sentence restates one displayed metric and its window: confirmed findings, critical count, KEV count, EPSS ≥ 50% count, open remediation items, and verification completeness. No sentence is generated beyond these metrics.

Not known by this lens:
  • A lower count after a partial scan is reported as reduced coverage, not as reduced risk.
  • Business impact and financial exposure: Not modeled

Previously called “Executive Risk Storyboard”. Renamed because the underlying evidence does not support that stronger claim.

Critical severity

0
CVSS base severity CRITICAL

EPSS ≥ 50%

0
Predicted exploit probability

On CISA KEV

0
Known exploited in the wild

Confirmed, patch-now bucket

0
Mean priority 0.00
How this works — definitions, thresholds, and what to doShow

Every sentence in the summary card restates exactly one displayed metric together with its scope and time window. No sentence is generated beyond these metrics, and no trend, forecast or financial impact is inferred.

Metrics used: records in scope, CRITICAL severity count, CISA KEV count, EPSS ≥ 50% count, and — in My environment mode — the canonical confirmed, needs-review and stale-evidence counts.

Not modeled: business impact and financial exposure (Not modeled). A fall in counts after a partial scan is reported as reduced coverage, never as reduced risk.