v0.6.0 · MIT License · Open source

Vulnerability governance
that runs on your machine.

Name: VulnPilot
Author: PatchVex

Prioritize Nessus findings using CISA KEV, EPSS, and CVSS. Track SLA compliance, manage risk exceptions, and generate SOC 2 and ISO 27001 audit evidence. No cloud. No account. No data leaves your environment.

pip install vulnpilot

Read quickstart View on GitHub

Data never leaves your machine Air-gap capable Python 3.10–3.12 77 tests passing

vulnpilot analyze scan.csv

$ vulnpilot analyze scan.csv

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

VulnPilot by PatchVex — Vulnerability Prioritization

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Total findings : 5,482

Unique hosts : 47

Critical : 142

High : 386

Medium : 1,520

KEV matches (exploited now) : 19

EPSS ≥ 90% (high risk) : 31

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

TOP 5 PRIORITIZED FINDINGS

# Score Priority Host CVE Finding

─────────────────────────────────────────────────────────────────────

1 100.0 CRITICAL NOW 192.168.1.10 CVE-2021-44228 Log4Shell ★KEV

2 100.0 CRITICAL NOW 192.168.1.25 CVE-2023-34362 MOVEit SQLi ★KEV

3 99.8 CRITICAL NOW 192.168.1.15 CVE-2020-1472 Zerologon ★KEV

4 99.7 CRITICAL NOW 192.168.1.11 CVE-2021-26084 Confluence RCE ★KEV

5 11.5 LOW 192.168.1.10 N/A SSH Weak Ciphers

★ KEV = CISA Known Exploited — highest remediation priority.

Local-first

Your data never leaves your environment

Open source

MIT licensed — read and audit every line

Daily threat feeds

CISA KEV + FIRST EPSS, updated automatically

No API keys

No accounts, no subscriptions, no lock-in

Why local-first?

Cloud-based vulnerability tools require you to upload scan data to a third-party service. VulnPilot runs entirely on your machine — the threat intelligence comes to you.

Data sovereignty

Scan results, host names, and CVE data never leave your environment. No vendor stores, indexes, or trains on your findings.

Air-gap capable

After the initial feed download, analysis runs fully offline. Deploy in classified networks, restricted environments, or disconnected labs.

Audit-grade evidence

Generate SOC 2 CC7.1 and ISO 27001 Annex A 8.8 evidence packs in one command. Hand the Markdown output directly to your auditor.

Composite scoring

CVSS alone doesn't tell you what's being exploited today. VulnPilot weights CISA KEV confirmation, EPSS probability, and CVSS severity into a single prioritization score.

SLA governance

Track remediation deadlines per finding against configurable SLA policy. Manage approved exceptions with ticket references, expiry dates, and audit flags.

Pipeline-native

JSON output and --fail-on-breach turn VulnPilot into a hard CI/CD gate. Exit 2 on unexcused SLA breach — integrates with GitHub Actions, GitLab CI, Jenkins.

See the score for yourself

Adjust the sliders to match a real finding. The formula is KEV(40) + EPSS(35) + CVSS(15) + Severity(10), with a hard floor of 75 for any KEV-confirmed finding.

KEV match 40 pts if confirmed

Not in CISA KEV

EPSS score × 35

0.05

0%50%100%

CVSS base score × 1.5

7.5

0510

Severity × 10

Priority score

—

How it works

VulnPilot cross-references your Nessus scan output against three public data sources — all processed locally. No vulnerability data is transmitted outside your environment.

        Public Threat Intelligence
    +-------------------------------+
    |  CISA KEV      FIRST EPSS     |
    +---------------+---------------+
                    |
            vulnpilot update-feeds
                    |
        ~/.vulnpilot/feeds/ (local cache)
                    |
            vulnpilot analyze
                    |
    Nessus CSV (Local Machine Only)
                    |
       Composite Risk Engine
                    |
       Prioritized Findings

Everything you need to govern vulnerabilities

From scan to audit evidence in one tool. No SaaS, no account, no data leaving your machine.

CISA KEV enrichment

Instantly flags CVEs confirmed exploited in the wild, sourced directly from CISA's authoritative catalog.

EPSS probability scoring

Adds FIRST EPSS exploitation probability so you focus on what's actively likely to be exploited — not just what's severe.

Composite priority score

KEV(40) + EPSS(35) + CVSS(15) + Severity(10) gives every finding a single, defensible score. No more CVSS-only guesswork.

Audit evidence packs

One-command Markdown output for SOC 2 CC7.1 and ISO 27001 Annex A 8.8. Hand it directly to your auditor.

Remediation verification

Diff new scans against history. Prove which findings were fixed, which are still open, and what's new — host-aware.

SLA compliance tracking

Per-finding SLA status against configurable thresholds — Critical 7d, High 30d, Medium 90d. Override per client.

Exception management

Exception register with ticket refs, approver, and expiry. Classifies breaches as approved, expired, or unexcused audit findings.

CI/CD pipeline gate

--fail-on-breach exits 2 on unexcused SLA breach. JSON output pipes to jq. Drop-in for GitHub Actions and GitLab CI.

Top hosts ranking

Ranks hosts by aggregate risk score so you know which servers to prioritize before even reviewing individual CVEs.

Audit evidence, generated

Run one command. Get a Markdown document your auditor can read — scan metadata, prioritized findings, SLA compliance, control mapping, and sign-off block included.

$ vulnpilot analyze scan.csv --evidence soc2 --evidence-out evidence.md

evidence.md — SOC 2 CC7.1 Evidence Pack

Vulnerability Management Evidence Pack

Control SOC 2 CC7.1 Generated 2026-07-18 Tool VulnPilot v0.6.0

§ 1 — Scan metadata

ScannerNessus Professional

Scan date2026-07-18

Hosts in scope47

Total findings5,482

§ 2 — Prioritized findings (top 5)

100.0CVE-2021-44228Log4Shell ★KEV

100.0CVE-2023-34362MOVEit SQLi ★KEV

99.8CVE-2020-1472Zerologon ★KEV

99.7CVE-2021-26084Confluence RCE ★KEV

72.1CVE-2022-47966ManageEngine RCE

§ 3 — SLA compliance

127

Within SLA

Approaching

Breached

§ 4 — Control mapping

SOC 2 CC7.1 requires the entity to identify, classify, and remediate vulnerabilities. This evidence pack demonstrates compliance with automated KEV and EPSS-enriched prioritization, documented SLA policy, and verified remediation records.

§ 5 — Sign-off

Security Lead

Date

Drop it into your pipeline

One step in CI gates every deploy against your SLA policy. Exit 0 = clean. Exit 2 = unexcused breach — your pipeline fails, your auditor sees proof.

GitHub Actions YAML

- name: Vulnerability governance gate
  run: |
    vulnpilot verify scan.csv \
      --sla-config clients/acme_sla.yaml \
      --exceptions clients/acme_exceptions.csv \
      --fail-on-breach \
      --json | tee vulnpilot-verify.json

Clean

No unexcused SLA breaches. Deploy continues.

Tool error

Invalid config, missing file, or parse failure.

Audit finding

SLA breach with no valid exception on file. Pipeline fails.

What's shipped, what's next

Development priorities are driven by community feedback and real-world usage.

v0.1.0

Community preview

CLI, CISA KEV enrichment, EPSS scoring, PyPI release

v0.2.0

HTML reports

Shareable export for stakeholders

v0.3.0

Audit evidence packs

SOC 2 CC7.1 evidence in one command

v0.4.0

Remediation verification

Prove findings were fixed across scan cycles

v0.5.0

Vulnerability governance

ISO 27001, SLA tracking, exception register, governance evidence

v0.6.0

CI/CD integration Latest

--json, --sla-config, --fail-on-breach pipeline gate

Later

More frameworks & scanners

DPDP, HIPAA evidence packs · Qualys and Rapid7 CSV support

Up and running in three steps

Requires Python 3.10, 3.11, or 3.12. No API keys. No account.

Install

pip install vulnpilot

Install from PyPI. No external dependencies beyond Python stdlib.

Download threat feeds

vulnpilot update-feeds

Fetches CISA KEV and FIRST EPSS to ~/.vulnpilot/feeds/. Re-run whenever you want fresh data.

Analyze your scan

vulnpilot analyze scan.csv

Where scan.csv is a standard Nessus CSV export. Prioritized findings in seconds.

Install on PyPI Read quickstart View on GitHub

Frequently asked questions

Does VulnPilot upload my scan data?

Does it work offline or air-gapped?

Yes, after the initial feed download. Run vulnpilot update-feeds once to cache data locally. After that, analysis works completely offline — no internet connection required.

Which scanners are supported?

Which audit frameworks are supported?

SOC 2 (CC7.1) and ISO/IEC 27001:2022 (Annex A 8.8) evidence packs ship today. DPDP and HIPAA packs are planned. Generate with: vulnpilot analyze scan.csv --evidence soc2

Is the evidence enough for a real audit?

How often are the threat feeds updated?

CISA KEV and FIRST EPSS publish new data daily. Run vulnpilot update-feeds anytime to pull the latest. No API key or account required.

Is it really free? No paid tier?

Can I use it commercially?

Vulnerability governancethat runs on your machine.

Why local-first?

See the score for yourself

How it works

Everything you need to govern vulnerabilities

Audit evidence, generated

Drop it into your pipeline

What's shipped, what's next

Up and running in three steps

Frequently asked questions

Vulnerability governance
that runs on your machine.