VulnPilot · Open Source · MIT · v1.0.0

Your scanner finds them.
VulnPilot proves you managed them.

Local-first CLI that prioritizes Nessus scan results using real-world exploit intelligence — then generates the audit evidence to prove you acted. Zero cloud upload. Zero API keys.

Quick start

Up and running in four commands.

No accounts, no API keys, no configuration files. Install, sync threat intel feeds once, then point it at any Nessus CSV.

1
pip install vulnpilot# install from PyPI — zero dependencies
2
vulnpilot update-feeds# download CISA KEV + FIRST EPSS (one-time)
3
vulnpilot analyze scan.csv# prioritize your Nessus export
4
vulnpilot analyze scan.csv --evidence soc2# generate SOC 2 CC7.1 evidence pack
Capabilities

Everything a vulnerability program needs.

Built to close the gap between your scanner output and your audit evidence — without requiring a SIEM or a dedicated vuln management platform.

Composite risk scoring

KEV (40%) + EPSS (35%) + CVSS (15%) + Severity (10%). Known exploited vulnerabilities score a minimum of 75. Deterministic and re-runnable.

Remediation verification

vulnpilot verify diffs a new scan against your history — classifying each finding as fixed, still open, or newly introduced. Scan-scope guard prevents false positives.

SLA compliance tracking

Configurable per-severity deadlines. Each finding is classified as within SLA, approaching, or breached — with approved, expired, and unexcused exception handling.

Audit evidence packs

One command generates a Markdown evidence pack mapped to SOC 2 CC7.1 or ISO 27001 A.8.8. Your scan history becomes your audit trail automatically.

Local scan history

Every analysis is recorded to a local SQLite database at ~/.vulnpilot/history.db. Never transmitted. SOC 2 Type II requires 6–12 months of evidence — VulnPilot builds it from day one.

CI pipeline gate

--fail-on-breach exits 2 when unexcused SLA breaches exist. --json on analyze and verify emits clean JSON for downstream consumers.

Why not CVSS alone

Severity tells you the ceiling.
KEV tells you the floor.

A typical mid-size scan flags hundreds of findings as CVSS Critical. CVSS scores severity if exploited — it says nothing about whether anyone actually is. CISA KEV is updated the moment confirmed exploitation is observed. EPSS is recalculated daily. VulnPilot blends all three so that "critical" means "actively being exploited right now" — not just "theoretically severe."

Composite score formula
CISA KEV
40%
FIRST EPSS
35%
CVSS base
15%
Severity
10%
Any KEV finding receives a minimum score of 75 regardless of CVSS.

Free and open source.

MIT licensed. Inspect every line. Start building your audit trail today.