Home › Free tools › Vulnerability scan prioritiser
Drop in your vulnerability scanner’s export. It picks out the flaws attackers are actually using today, from CISA’s exploited list, flags those used in ransomware and on internet-facing addresses, and turns the rest into a patch plan: today, this week, this month, later. Read in your browser.
Patch prioritiesThe exploited list in this tool is more than two weeks old. Newly exploited flaws may be missing; the order is still right for those it knows.
1 Summary
2 The checks
3 The patch plan
4 Hosts with the most to fix
5 What this could not check
Prioritised against CISA’s Known Exploited Vulnerabilities catalogue. Read in your browser; the scan was never sent to us. Guidance, not a penetration test; see the terms.
Every scanner exports to CSV. Include the CVE column; the host and severity columns make the plan sharper.
What happens to it: it is read in your browser and dropped once the report is drawn. Nothing is uploaded, and our copy of your details carries only the counts, never a host, an address or a CVE.
The questions people search for before they run the check.
The ones attackers are already exploiting. CISA's Known Exploited Vulnerabilities list names them, and flags those used in ransomware. Patch those first, internet-facing systems before internal ones, then critical flaws not yet exploited, then the rest in the monthly cycle.
The US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with confirmed exploitation in real attacks, each with the date it was added and whether it is known to be used in ransomware campaigns. It is free and updated as new exploitation is seen.
CVSS measures how bad a flaw could be, not whether anyone is using it. Most critical-rated flaws are never exploited, while some exploited ones score lower. Ranking by exploitation first puts the effort where attacks actually happen.
CSV exports from Nessus and Tenable, OpenVAS and Greenbone, Qualys, Rapid7 and Microsoft Defender Vulnerability Management, or any CSV with a CVE column. A plain list of CVE IDs works too.
No. It is read in your browser and dropped once the report is drawn. If you ask for the report, we keep your details and a one-line summary with the counts, never a host or a CVE.
Exploiting unpatched flaws is now the most common way into a network. Fixing the few on the exploited list, quickly, does more than fixing a thousand by score.