Base score
The intrinsic severity of the vulnerability, stored for full auditability.
Code-to-cloud insurance.
Flagship
VibeDefend
Learns your project's rules, watches every prompt, lets the agent ship secure code from the start.
AI Agents
Scanners
- AI SASTStatic analysis with reachability
- SCADependencies + license risk
- Secret DetectionCatch leaked tokens before commit
- License ComplianceOpen-source license risk, classified
- AI IaCTerraform · Cloudformation · Ansible · K8s
- Container SecurityImage scanning + runtime context
- AI CI/CDGitHub Actions · GitLab CI · Jenkinsfile · Tekton
- AI-BOMAI Bill of Materials · EU AI Act + NIST AI RMF
Platform · Risk Intelligence
Fix what matters first. Priority Scoring & CybeRisk.
Severity alone never told you what to fix. CybeDefend scores every finding and ranks every project by real, exploitable risk, so your team spends its time where it counts.
87priority scoreCritical urgent
- 80+Critical urgent
- 60+Urgent
- 40+Normal
- 20+Low
- < 20Very low
Hover a signal to see its share of the score.
CVSS 4.0 environmental score, EPSS exploitation probability, exploitability and business context, weighted into a single number.
Next to fix
What to fix first, in this order.
The queue advances by priority score, not by severity alone.
Next to fix
critical
CWE-8992SQL injection in refund handler
api/refunds.ts:88Reachable from POST /refunds on an internet-facing service.
provenEPSS 0.94Click the top card to advance the queue.
Exploitability
exploitability_statusnot_exploitableFalse positive or unreachable. De-prioritized.theoreticalPossible, not yet confirmed reachable.provenConfirmed exploitable in your real data flow.actively_exploitedKnown exploitation in the wild. Drop everything.
Every finding gets a verdict on whether it is realistically reachable, from static analysis, AI review or a manual call.
CybeRisk Score
Which project deserves attention first.
One CybeRisk score per project, so you know which of a hundred projects to open first.
CVSS 4.0
The severity vector, tuned to your context.
Both scores start from CVSS 4.0. The same CVE scores higher on an internet-facing, mission-critical service than on an isolated internal tool.
Environmental score
Reshaped by your Security Context, and recomputed automatically when it changes.
Reshaped by your contextInternet exposure · Network segmentation · Data classification · Business criticality
How it works,
in detail.
The documentation walks you through setup, configuration and every option.
Read the docsPlatform Overview / Key Features
Priority Scoring
The 0 to 100 formula and its weights, CVSS 4.0, EPSS, exploitability and context, the levels and manual override.
FAQ
Scoring & prioritization, in short
What is the difference between the priority score and the CybeRisk score?
The priority score ranks individual findings inside a project so you know what to fix first. The CybeRisk score ranks whole projects across your portfolio so you know which project to look at first. One is finding-level, the other project-level.
How is the priority score calculated?
It blends four normalized signals: CVSS 4.0 environmental score, EPSS exploitation probability, exploitability and business context. The weighted result is a transparent 0 to 100, and every finding can be decomposed into its exact contributions.
What does exploitability mean here?
It is a verdict on whether a finding is realistically reachable, from not_exploitable to actively_exploited, sourced from static analysis, AI assessment or a manual override. It is the single biggest driver of false-positive suppression.
Why is the CybeRisk score not capped at 100?
Because it sums point contributions from every active finding rather than a percentage. A project with many critical vulnerabilities can legitimately score in the hundreds, which keeps the worst offenders clearly separated.
Can I override a priority manually?
Yes. Authorized users can pin a priority, which freezes recalculation until it is cleared. Overridden findings are flagged so it is always clear a human set the score.
Install VibeDefend in 5 seconds.
One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.
Install in 5 secondsNode 18.17+
npx -y @cybedefend/vibedefend@latest installAuto-detects
Claude Code
Cursor
OpenAI Codex
Windsurf
VS Code Copilot