Your scanner finds them.
VulnPilot proves you managed them.
Local-first CLI that prioritizes Nessus scan results using real-world exploit intelligence — then generates the audit evidence to prove you acted. Zero cloud upload. Zero API keys.
Up and running in four commands.
No accounts, no API keys, no configuration files. Install, sync threat intel feeds once, then point it at any Nessus CSV.
Everything a vulnerability program needs.
Built to close the gap between your scanner output and your audit evidence — without requiring a SIEM or a dedicated vuln management platform.
Composite risk scoring
KEV (40%) + EPSS (35%) + CVSS (15%) + Severity (10%). Known exploited vulnerabilities score a minimum of 75. Deterministic and re-runnable.
Remediation verification
vulnpilot verify diffs a new scan against your history — classifying each finding as fixed, still open, or newly introduced. Scan-scope guard prevents false positives.
SLA compliance tracking
Configurable per-severity deadlines. Each finding is classified as within SLA, approaching, or breached — with approved, expired, and unexcused exception handling.
Audit evidence packs
One command generates a Markdown evidence pack mapped to SOC 2 CC7.1 or ISO 27001 A.8.8. Your scan history becomes your audit trail automatically.
Local scan history
Every analysis is recorded to a local SQLite database at ~/.vulnpilot/history.db. Never transmitted. SOC 2 Type II requires 6–12 months of evidence — VulnPilot builds it from day one.
CI pipeline gate
--fail-on-breach exits 2 when unexcused SLA breaches exist. --json on analyze and verify emits clean JSON for downstream consumers.
Severity tells you the ceiling.
KEV tells you the floor.
A typical mid-size scan flags hundreds of findings as CVSS Critical. CVSS scores severity if exploited — it says nothing about whether anyone actually is. CISA KEV is updated the moment confirmed exploitation is observed. EPSS is recalculated daily. VulnPilot blends all three so that "critical" means "actively being exploited right now" — not just "theoretically severe."
Free and open source.
MIT licensed. Inspect every line. Start building your audit trail today.