External attack surface · change intelligence
Know what changed on your perimeter overnight, and whether it matters.
CVERisk syncs your cloud, DNS and registrar accounts, verifies what you own, and turns thousands of daily observations into a short list of material changes with evidence, CVE applicability and a clear next action.
No agents. Read-only connectors. EU data residency available.
- Action
Admin interface on port 8443 became reachable
vpn-emea.meridian-retail.com
- Action
KEV added for observed Acme Secure Gateway 4.2.1
vpn-emea.meridian-retail.com
- Action
Dangling CNAME to deprovisioned S3 bucket
legacy-promo.meridian-retail.com
- Investigate
Asset reactivated after 6 months inactive
grafana.meridian-retail.com
- Investigate
New SAN added to checkout certificate
checkout.meridian-retail.com
From raw internet data to a decision your team can defend
- Step 1
Connect sources
Read-only connectors for AWS, Azure, Google Cloud, Cloudflare, registrars and your CMDB, plus Certificate Transparency to catch shadow IT.
- Step 2
Verify and authorize
Prove domain control with DNS TXT or an HTTP file and sign rules of engagement. Active probes never run against unverified scope.
- Step 3
Detect material change
Daily or hourly baselines are diffed, deduplicated and reproduced. Noise is suppressed with a recorded reason.
- Step 4
Act with evidence
Each change gets a policy band, CVE applicability and remediation steps, routed to Slack, Jira or ServiceNow.
One platform for the whole exposure lifecycle
Discovery tools tell you what exists. CVERisk tells you what changed, who owns it and what to do next.
AI Copilot
Ask "what changed for Helvetia this week?" and get an answer grounded in your inventory, with links to the evidence.
Asset sync
Inventory stays current from the accounts you already run. Removed resources are flagged, not silently forgotten.
Automations
Event-driven rules with dry runs against historical data, retries and a full execution log.
Built for MSSPs
Tenant isolation, portfolio overview, white-label reports and per-client SLAs from one console.
Risk exceptions
Time-boxed acceptances with compensating controls, approvals and automatic expiry.
API and SIEM export
Push assets from Terraform or CI, pull changes into Splunk, Sentinel or your data lake.
Connects with
- AWS
- Azure
- Google Cloud
- Cloudflare
- Akamai
- Fastly
- MarkMonitor
- ServiceNow
- Jira
- Slack
- Microsoft Teams
- Splunk
Safe to point at production
Verification before scanning
Ownership proof, signed authorization, scan windows and exclusions are enforced by the scheduler.
Least privilege by design
Connectors use read-only roles with External IDs. Secrets are encrypted per tenant and never shown again.
Complete audit trail
Every decision, scan, sync and automation run is recorded and exportable for auditors.
Priced by organizations and assets, not by scans
Every plan includes verification-first scanning, CVE correlation and the AI exposure brief. Scans are unlimited within your asset allowance. Annual billing saves two months. 14-day trial, no card required.
Starter
One organization, continuous external monitoring.
€390per month
€3,900 / yr
- organizations
- 1
- assets
- 150
- seats
- 3
- retention
- 90 days
- Daily passive discovery, weekly active scans
- CVE correlation (NVD, KEV, EPSS)
- Domain verification & scan authorization
- AI exposure brief
- Email notifications
- CSV exports
€2.00 per extra asset / mo
Start free trialProfessional
Most popularSecurity teams monitoring several business units.
€1,290per month
€12,900 / yr
- organizations
- 5
- assets
- 1,500
- seats
- 15
- retention
- 1 year
- Everything in Starter
- Hourly change detection, daily active scans
- AI Copilot (1,000 questions / mo)
- Automations (25 rules)
- Cloud & DNS sync connectors
- Slack, Jira & webhooks
- SSO (SAML)
€0.80 per extra asset / mo
Start free trialMSSP
Multi-tenant portfolio for managed service providers.
€2,900per month, from
from €29,000 / yr
- organizations
- 25
- assets
- 10,000
- seats
- 50
- retention
- 3 years
- Everything in Professional
- Portfolio overview & tenant isolation
- Unlimited Copilot & automations
- White-label reports & AI client updates
- API & SIEM export
- 99.9% uptime SLA
€95 per extra client org · €0.25 per asset
Talk to salesEnterprise
Large estates with residency and deployment requirements.
Customannual contract
typically €45k+ / yr
- organizations
- Unlimited
- assets
- 50,000+
- seats
- Unlimited
- retention
- Custom
- Everything in MSSP
- On-prem scanner agents for internal ranges
- Dedicated worker pools & egress IPs
- EU / US data residency
- SCIM, audit export & custom roles
- Dedicated CSM & 99.95% SLA
Committed volume pricing
Talk to salesPrices exclude VAT. An asset is a monitored hostname, IP, or certificate that is in scope. Shared infrastructure and rejected candidates are never billed.
Questions security teams ask
How do assets get into CVERisk before any scan?
Through sources: root domains and IP ranges you add as seeds, read-only cloud/DNS/registrar connectors, CSV or API imports, and passive intelligence such as Certificate Transparency. Assets from accounts you control are confirmed automatically; everything discovered publicly goes through Candidate Review first.
Will you scan things we do not own?
No. Passive collection only touches public data. Active probes require a verified domain, a signed authorization and an open scan window. Shared infrastructure such as CDN anycast ranges is never treated as owned.
What does the AI actually do?
It summarizes and explains. The Copilot answers questions using read-only tools over your workspace data and cites assets and changes. It never changes policy bands or runs scans on its own.
Can we run it for multiple clients?
Yes. The MSSP plan gives you tenant isolation, a portfolio overview, per-client reports and role-based access per organization.
See your own perimeter in 15 minutes
Add a root domain, connect one cloud account, and get your first exposure brief today.