Use Case: Vulnerability Management
Exploit-aware vulnerability prioritization
Your scanner returned 14,000 critical CVEs this week. ManySignal cross-referenced them against CISA KEV, active exploit availability, and your asset criticality registry. Eleven require immediate action. The rest can wait.
Typical enterprise environment with 5+ vulnerability scanners
After exploit maturity + asset criticality + active campaign correlation
From KEV addition to widespread enterprise exploitation activity
CVSS 9 on a dev server is not your biggest problem
Vulnerability scanners produce CVSS scores that measure theoretical severity in isolation. They do not know that the CVSS 6 vulnerability on your payment processing server is being actively exploited by a ransomware gang this week, while the CVSS 9 vulnerability on your isolated development server has no public exploit and has never been used in the wild. CVSS-first prioritization sends remediation teams to the wrong places.
ManySignal's prioritization engine layers three additional signals on top of raw CVSS: exploit maturity (PoC? Metasploit module? Active campaign?), asset criticality (internet-facing? PII? Production?), and real-time threat intelligence (in CISA KEV? Observed in threat actor TTP reports this week?). The result is a prioritized remediation queue where the top items are genuinely urgent.
model: exploit_aware_vulnerability_prioritization
inputs:
- scanner_findings: tenable / qualys / rapid7 / wiz
- threat_intel: cisa_kev, recorded_future, exploit_db, metasploit
- asset_registry: criticality_tier, exposure, data_classification
scoring:
base: cvss_score (0-10)
multipliers:
+ exploit_available: +2.0 (PoC public)
+ metasploit_module: +2.5 (weaponized)
+ cisa_kev: +3.0 (confirmed exploited)
+ active_campaign: +3.5 (targeted at your sector)
+ internet_facing: x1.5 (asset exposure)
+ pii_or_payment_data: x1.3 (data sensitivity)
output:
- priority_queue: ranked by composite score
- immediate_action: cisa_kev + metasploit + internet_facing
- kev_alerts: real-time when inventory CVE added to KEV
- remediation_window: estimated days before exploitation
- owner: assigned team based on asset_owner registryDetection sketch
trigger: cisa_kev.new_addition OR scanner.finding.new
condition:
cve: in asset_inventory
AND (
cisa_kev: true
OR exploit_db.public_exploit: true
OR recorded_future.risk_score > 75
)
action:
- fire: immediate_alert (bypass scheduled scan cycle)
- assign: asset_owner + vuln_team
- sla: 24h patch / 4h workaround for KEV itemsLegacy approach comparison
- 14,000 critical/high items competing for attention
- Patch cycle 30-60 days for critical items
- No signal on exploit availability at scan time
- Internet-facing and internal assets scored identically
- KEV additions discovered on next scan cycle
- 11 items flagged immediate from same dataset
- 24-hour SLA for KEV + exploit-available items
- Exploit maturity scored at finding time
- Asset criticality multiplier built into scoring
- Real-time KEV alert within minutes of addition
MITRE ATT&CK coverage
Vulnerability prioritization FAQ
How does ManySignal know which vulnerabilities are exploited in the wild?
ManySignal ingests CISA KEV (Known Exploited Vulnerabilities catalog), Exploit-DB, Metasploit module availability, and commercial threat intelligence from Recorded Future and CrowdStrike. A vulnerability is flagged as actively exploited when any of these sources confirm public exploit availability combined with observed exploitation in threat actor campaigns.
How does asset criticality factor into prioritization?
ManySignal maintains an asset criticality registry that classifies assets by data sensitivity (PII, PCI, PHI), exposure (internet-facing vs. internal), and business function (production, payment, identity infrastructure). CVSS scores are reweighted based on asset criticality — a CVSS 6 vulnerability on the payment database scores higher than a CVSS 9 on an isolated dev server.
Can ManySignal integrate with existing vulnerability scanners?
Yes. ManySignal ingests from Tenable, Qualys, Rapid7 InsightVM, and Wiz via API or SIEM forwarding. Vulnerability findings are correlated with threat intelligence and asset context to produce the prioritized remediation queue. ManySignal does not replace the scanner — it adds the context layer that transforms raw CVSS scores into actionable priority.
How does ManySignal alert when a vulnerability moves from theoretical to actively exploited?
ManySignal monitors CISA KEV and Recorded Future in near-real-time. When a CVE already in your asset inventory is added to KEV or gains confirmed exploit activity, ManySignal fires an immediate alert — separate from your scheduled scan cycle. This typically provides 2-3 weeks of warning before exploitation is observed in enterprise environments.
Find the 11 vulnerabilities that matter this week, not the 14,000
Exploit maturity, asset criticality, and real-time KEV alerts — CVSS scores with context.