Reference

EPSS & KEV explained

CVSS measures theoretical severity — how bad a vulnerability could be. EPSS (Exploit Prediction Scoring System) scores the probability that a CVE will be exploited in the wild within 30 days. CISA KEV is the Known Exploited Vulnerabilities catalog: a ground-truth list of CVEs that are being exploited right now.

Vertix enriches every finding with EPSS score and KEV membership. A CVSS 9.8 nobody exploits ranks below a CVSS 6.5 on the KEV list — severity alone lies to you, exploitability tells you what to fix first.

Compliance mapping methodology

Control alignment is deterministic: each scanner finding carries a ruleKey mapped by hand to framework controls, correlated with CVE and CWE references. The same scan always produces the same control matrix — auditors get repeatable evidence rather than model output.

Data retention

• Starter — 90 days
• Growth — 90 days
• Pro — 180 days
• MSP / Enterprise — 365 days
• Expired findings are archived automatically; reports generated before expiry are retained as PDFs