Threat intelligence

Context tells you how dangerous a vulnerability is to your organization

Threat intelligence is only useful when it lands on your assets, your exposure and your business context. AegisVMP correlates the outside world with the inside one.

Daily Threat Brief

Today's threats, counted against your own CVEs

Each day the AI researches current campaigns, newly exploited vulnerabilities and advisories, then correlates every item with the CVEs open on your assets — so the brief tells you how many of your machines each threat touches.

AegisVMP Cyberthreat TIP page with the daily threat brief and internal CVE counts — Cyberthreat TIP — the Daily Threat Brief

Corroborated signals

Evidence, not isolated alerts

When endpoint telemetry agrees with an open vulnerability, the finding is flagged Corroborated for an analyst to act on. The flag does not change the score by itself.

Vulnerability dataThe finding exists on a known asset.

Threat intelligenceCISA KEV, EPSS and the daily threat brief.

Endpoint telemetryA detection rule fired on the same machine.

Corroborated signal

When telemetry agrees with a vulnerability, the finding is flagged.

When endpoint telemetry agrees with an open vulnerability on the same asset, AegisVMP flags the finding as Corroborated so an analyst can act on it. The flag does not change the priority score by itself.

Independent sources agree
Flagged Corroborated for analyst action
The reasoning stays attached to the finding

AegisVMP security signals view correlated with vulnerability data — Threat Correlation

Contextual risk

Severity describes the flaw. Context describes the danger.

Six weighted factors — CVSS base, EPSS, asset criticality, reachability, business impact and recurrence — and a floor that forces any CISA KEV-listed finding into the Critical tier.

Severity alone

One number, no context

A severity rating describes the vulnerability. It does not describe your organization.

Finding AHigh
Finding BHigh
Finding CHigh

Three findings look identical, so the queue offers no guidance.

Contextual risk

Severity plus organization context

EPSS, CISA KEV, reachability, asset criticality and business impact separate the same three findings.

Finding ACritical
Finding BModerate
Finding CLow

Context tells you how dangerous a vulnerability is to your organization.

Contributing factors

What goes into a score

CVSS base
The technical severity of the vulnerability.
EPSS
FIRST's estimate of how likely exploitation is in the next 30 days.
Asset criticality
How important the affected asset is to the organization.
Reachability
Whether the asset can be reached from the internet, and how.
Business impact
What the asset's failure or compromise would mean to the business.
Recurrence
Whether the issue keeps coming back after it was fixed.

Scores are explainable: every factor that moved a finding up or down stays visible.

Exposure

A calculated score, not a label

is a score from 0 to 100 that AegisVMP works out for every asset from three inputs. It feeds into contextual risk alongside threat intelligence and business context.

Internet reachability
Can the asset be reached from the internet, directly or through a published service?
raises exposure
Exposed services
Which ports and services are open, and how risky each one is.
raises exposure
Compensating controls
Firewalls, segmentation and other controls that reduce what can be reached.
lowers exposure

AegisVMP exposure analysis view showing reachability of affected systems — Exposure analysis

Attack path intelligence

Entry routes from the internet

Each attack path is a route from the internet to an exposed asset and a vulnerability on it. Routes are scored so the most dangerous entry points come first.

Internet Exposed asset Vulnerability on the assetEach route is scored and mapped to ATT&CK tactics

AegisVMP attack graph view showing relationships between systems and vulnerabilities — Attack Graph

MITRE ATT&CK alignment

Mapped across ATT&CK and both kill chains

Findings, attack paths and detection rules are mapped to ATT&CK tactics and techniques, and viewed across the Lockheed Martin Cyber Kill Chain and the Unified Kill Chain. Coverage exports straight to ATT&CK Navigator.

AegisVMP ATT&CK Coverage page mapping findings to tactics and kill chains — ATT&CK Coverage

Plain language

The vocabulary, defined

Shared definitions so security, engineering and leadership discuss the same concepts the same way.

CVSS: Measures the technical severity of a vulnerability.
EPSS: Estimates the probability that a vulnerability will be exploited.
CISA KEV: A catalog of vulnerabilities known to have been actively exploited.
Exposure: A 0–100 score calculated from internet reachability, exposed services and compensating controls.
Attack Path: A scored route from the internet to an exposed asset and a vulnerability on it.
Contextual Risk: A weighted score from CVSS, EPSS, asset criticality, reachability, business impact and recurrence.
Corroborated: A flag on a finding when endpoint telemetry agrees with the vulnerability. It prompts analyst action.

Bring context to your own findings

Request a walkthrough of AegisVMP and see how unified intelligence changes what your team works on first.

Request a Demo AI intelligence