Evidence01
- Nessusreport
OpenVASreport- Rapid7 InsightVMreport
- Qualysreport
Findings never stop. Cube tells you what to fix — and why
Cube reads the reports your scanners already produce, adds the business context they never see, and returns a decision you can defend — inside your perimeter, on your model.
Triage About 10× fewer risk cases than findings — the queue your team actually works.
- ×10fewer risk cases than raw findings
- hoursfrom first report to ranked decisions
- your modelruns on the LLM you already trust
- your perimeternothing leaves your environment
The problem
Turn thousands of findings
Turn thousands of findings
into confident action
Security chaos starts when the context lives somewhere else:
scanners produce CVEs, not business capabilities.
- 01
“The score doesn’t know my network”
Scanner severity is computed without your assets, exposure or controls. The ranking you get is not the ranking you need.
- 02
“I can’t read 3,000 findings”
Findings arrive faster than any team can triage them by hand.
- 03
“I can’t explain my choice”
The business asks what it costs. Auditors ask why this and not that. A spreadsheet of scores answers neither.
What changes
Cube collapses findings into roughly 10× fewer risk cases — that is the queue your team actually works.
How Cube works
Three layers, one system
What comes out
Risk cases
Attack paths
Threat profile
The platform
What each layer does
Unified evidence gives the model something real to reason over, business context tells it what the asset is worth, and the decision layer turns that into a call your board and your auditor both accept.
Evidence Layer
Read every scanner report as it is
Cube reads the reports your scanners already produce — Nessus, OpenVAS, Acunetix and others — and resolves every finding onto a real asset. There is no connector to build.
Context Layer
Know what the asset is worth
Assets, relationships, compliance scope and the business capabilities behind them, built from the infrastructure documents you already have. This is the part a scanner never sees.
Decision Layer
Return a call you can defend
The CISA SSVC model run against your environment: exploitation, exposure, mission impact, attacker utility. Every step stays open to review and correction.
Worked example
One finding, from your screen
One finding, from your screen
to your decision
The same Log4Shell finding — what your scanner shows you today, and what you would have to work out on your own.
- 01
What you see today
CVE-2021-44228
Apache Log4j2 JNDI lookup remote code execution.
- 02
What you do not see
card-token101
Tokenization API in eu1 — replaces PANs with tokens, sits at the core of the PCI CDE.
- 03
What you no longer do by hand
Immediate
Exploited in the wild, reachable from the merchant portal, and it carries card-data protection.
- 04
What you can finally say
Card tokenization compromised
A sentence you can say to the CFO — not a CVE number.
Why it matters
The finding Cube tells you to ignore
Prioritisation only earns trust when it also takes work away.
CVSS 9.8
Track
Critical RCE on an internal build server. No inbound path from outside, nothing in the payment flow behind it, no active exploitation.
Stays in the queue. Nobody works the weekend for it.
CVSS 7.5
Act
Medium-severity flaw on the public payment gateway. Reachable from the internet, and merchant payment acceptance sits behind it.
Fixed today, with the reasoning written down.
Same scanner. Same morning. Your severity column ranks them the other way round.
What you get
Keep your scanners.
Keep your scanners.
Add the layer they never had.
Keep your scanners and workflows. Cube adds the missing decision layer: business context, transparent reasoning, and human control.
| Your current stack | What Cube adds | |
|---|---|---|
| Scanner output | Findings, severities, and alerts | A decision layer with the reasoning shown |
| Context | Technical issues in isolation | Tied to your asset graph and business processes |
| Business view | Security data and business impact stay disconnected | Risk cases the business can understand |
| Control | Manual triage or opaque automation | Transparent reasoning with human correction |
| Auditability | Notes, tickets, or spreadsheets | Evidence, author, and timestamp in every record |
| Deployment | Integration-heavy rollout | First results in hours, inside your boundary |
How it works
Cube does not collect findings.
Cube does not collect findings.
It re-ranks them.
Any scanner report goes in — no connector to build. Out comes a decision with the reasoning attached.
Scan reports · any scanner
- Nessus
- OpenVAS
- Rapid7 InsightVM
- Qualys
- Acunetix, and others
Infrastructure knowledge
- Jira · Confluence · Notion
- Architecture docs & diagrams
- Cloud, runtime and controls
SSVC decision
- ExploitationIs it being exploited in the wild right now?
- ExposureCan an attacker actually reach this asset?
- Mission impactWhat business capability breaks if it falls?
- Attacker utilityWhat does the attacker gain by taking it?
- DecisionAct · Attend · Track — with the reasoning attached
Risk case
A business-readable statement with impact and materiality.
Attack path
The technique chain across your real asset graph, mapped to MITRE ATT&CK.
Threat profile
Org-wide posture and a board-ready executive brief.
Infrastructure understanding
Inventory.
Inventory.
Automated.
Connect business impacts with assets. Understand attacker attractiveness.
Business impacts
What the business
What the business
actually stands
to lose
Business impact targets provide a clear view of the real risks.
Risk cases
From 3,000 findings
From 3,000 findings
to a queue you can work
Cube connects scanner findings with environment context and business impact — turning technical issues into cases you can act on.
Attack paths
How an attacker actually gets there
Technique chains across your real asset graph, mapped to MITRE ATT&CK.
What the screen shows
- A source → target chain across real assets, not a generic kill-chain diagram.
- Each step is saved on its own and stays recoverable.
- Evidence citations behind every claim — scan file, SSVC assessment, asset link.
- Wired to the finding and the risk case it belongs to.
By role
Risk breaks down when context
Risk breaks down when context
gets lost between teams
Keep security and engineering aligned by turning the same exposure
into the context each team needs to act.
Actionable engineering context
See which asset is affected, which team owns it, what business capability is at risk, and what work should move first — so engineering can act without blindly derailing the roadmap.
Defensible business context
See the exposure in business terms, with clear accountability, business impact, and rationale — so every decision stands up to the board, the auditor, and the business.
Where it fits
Built for environments where
Built for environments where
the answer has to be defensible
Every decision Cube makes carries the evidence, the business context and the rule it was decided by — exportable, reproducible, auditable.
PCI DSS
Cardholder-data scope is a business attribute, not a CVSS score. Cube tags the assets that carry it and ranks their findings first.
GDPR
Systems processing personal data get their own materiality weight, so a medium CVE on a PII store outranks a critical on a test box.
SOC 2
Every remediation decision keeps its evidence trail — what was found, why it mattered, what rule fired, who acted.
SOX
Financial-reporting systems are marked as such, and changes to their risk posture are reproducible on demand.
Deployed in your perimeter. Your model, your data, your retention policy — nothing leaves the environment you control.
One record, three readers
The same record answers
The same record answers
the board and the auditor
The same risk record serves three audiences: business sees the impact and priority, security sees the reasoning and technical context, audit sees the evidence, author, and timestamp.
Assessment
What the risk means for the business — impact, exposure, priority.
Rationale
Why the AI reached this conclusion, step by step, open to correction.
Evidence
Every claim traceable to a source a reviewer can open, with author & timestamp.
Trust but verify
Every AI output carries its reasoning, and you can correct it and regenerate. The AI never has the final word.
Deployment
What it takes to run Cube
Three steps to first results — and exactly what we need from you.
- 01
Point Cube at a model
Cube needs an LLM. Point it at any endpoint speaking the OpenAI or Anthropic protocol, inside your perimeter.
- 02
Load your context
Upload infrastructure documents and scan reports. Cube builds the asset graph and maps findings onto it.
- 03
Get decisions
Risk cases, attack paths and a threat profile — each one carrying the reasoning behind it.
- LLM
- OpenAI or Anthropic protocol
- Recommended models
- grok 4.6 · DeepSeek-V4-Pro · GLM 5.3
- Network
- Nothing leaves your perimeter
- From you
- Infra context + scan reports
FAQ
Questions we get first
The six things a technical reader asks before anything else.
Any popular scanner report — Nessus, OpenVAS, Acunetix and others. The model reads the report file, so there is no per-scanner connector.
A product integration API comes later.
Yes — it is the core of the product. Cube speaks the OpenAI and Anthropic protocols, on an endpoint inside your perimeter.
Recommended: grok 4.6, DeepSeek-V4-Pro, GLM 5.3.
No. Cube consumes scanner output and adds the decision layer your scanners cannot provide.
Nowhere. The platform and the model both run inside your boundary.
No. CVSS becomes one input into the SSVC decision, alongside exposure and business impact.
Hours from the documentation you already have — not weeks of integration work.
Get started
Ready for live demo?
Bring the infrastructure docs you already have, and we’ll stand up a pilot on your own environment — typically within a day. You keep the results, the decisions and the full audit trail.
- Set up your own LLM, keeping all data processing on your side
- First Inventory & threat profile in hours, from documents you already have
- Run SSVC & attack scenarios on your real assets — no rip-and-replace
The form didn’t load.Email your request to sales@vulners.com.
We’ll reply within one business day. No spam — ever.
Request received
We’ll reply within one business day.