Whitepaper
Vulnerability Management and Threat Intelligence with BaseFortify
Modern vulnerability management requires more than collecting lists of security weaknesses. Organizations must identify which vulnerabilities affect their systems, understand the likelihood of exploitation, and prioritize remediation based on actual risk.
BaseFortify is a vulnerability management and cyber threat intelligence platform developed by Axxemble, the company behind the Base27 Information Security Management System (ISMS).
By combining CVE intelligence, software inventory monitoring, CPE matching, CVSS severity scores, EPSS exploitation probabilities, and known exploitation data, BaseFortify helps organizations make informed security decisions.
Effective vulnerability management is not about fixing every CVE in order of severity. It is about identifying the vulnerabilities that matter most to your environment and addressing them according to risk.
This whitepaper explores the principles behind BaseFortify, including:
- Continuous CVE monitoring and vulnerability intelligence.
- Software inventory and attack surface visibility.
- Risk-based vulnerability prioritization using CVSS, EPSS, and CISA KEV.
- Canonical vendor and product naming.
- Common Platform Enumeration (CPE) matching.
- Vulnerability remediation and security monitoring.
- Supporting cybersecurity governance and compliance.
The Challenge of Modern Vulnerability Management
Security teams face a continuous stream of newly disclosed vulnerabilities affecting operating systems, applications, network devices, and software dependencies.
Public vulnerability databases provide extensive technical information, but determining which vulnerabilities apply to a particular organization remains a significant challenge.
Traditional vulnerability management approaches can produce large volumes of findings without sufficient context to determine which issues should be addressed first.
Organizations need answers to several important questions:
- Which newly published CVEs affect our systems?
- Are the affected products and versions present in our environment?
- How severe are the vulnerabilities?
- Are attackers actively exploiting them?
- Which vulnerabilities should be prioritized for remediation?
- How can we monitor changes in vulnerability intelligence?
BaseFortify addresses these challenges by connecting vulnerability intelligence with the software components that organizations monitor.
How BaseFortify Supports Vulnerability Management
BaseFortify provides a centralized environment for monitoring vulnerabilities and understanding their potential impact on registered systems and applications.
The platform combines information from established cybersecurity sources, including the National Vulnerability Database (NVD), MITRE's CVE ecosystem, FIRST's Exploit Prediction Scoring System (EPSS), CISA's Known Exploited Vulnerabilities catalog, and vendor security advisories.
Its principal capabilities include:
- CVE monitoring: Tracking newly disclosed vulnerabilities and updates to existing records.
- Software component monitoring: Maintaining an inventory of applications and operating systems relevant to the organization.
- Automated vulnerability matching: Connecting published vulnerabilities with registered products using standardized identifiers and product information.
- Risk prioritization: Evaluating vulnerability severity, exploitation probability, and evidence of active exploitation.
- Security notifications: Informing users about newly identified vulnerabilities affecting monitored components.
- Vulnerability analysis: Providing technical descriptions, references, and supporting intelligence to assist investigation and remediation.
Attack Surface Management and Software Inventory
Attack Surface Management (ASM) is the process of identifying, monitoring, and reducing the assets and potential entry points that attackers could exploit.
An organization's attack surface may include:
- Internet-facing websites, applications, and services.
- Servers, workstations, and operating systems.
- Network devices and security appliances.
- Cloud infrastructure and externally hosted applications.
- Third-party software and dependencies.
- Outdated or unsupported software components.
Maintaining an accurate inventory of these assets is an essential foundation for effective vulnerability management.
BaseFortify supports attack surface visibility by allowing organizations to register and monitor the software components used within their infrastructure.
When relevant vulnerability information becomes available, monitored components can be matched against affected product information.
A reliable software inventory transforms general vulnerability intelligence into information that is relevant to an organization's own environment.
BaseFortify's component-based monitoring complements broader attack surface management practices. It does not replace network discovery, configuration assessment, or dedicated vulnerability scanning tools.
Understanding CVE Intelligence
The Common Vulnerabilities and Exposures (CVE) program provides standardized identifiers for publicly disclosed cybersecurity vulnerabilities.
Each CVE identifier, such as CVE-2026-12345, allows security professionals, software vendors, and vulnerability databases to refer to the same security issue consistently.
CVE identifiers are an important foundation for vulnerability intelligence, but a CVE record alone may not provide all the information needed to evaluate organizational risk.
Additional intelligence may include:
- Affected vendors, products, and software versions.
- Technical vulnerability descriptions.
- CVSS severity scores.
- EPSS exploitation probabilities.
- Known exploitation indicators.
- Common Weakness Enumeration (CWE) classifications.
- Vendor advisories and remediation instructions.
- Security research and technical references.
BaseFortify brings together these sources of information to provide enriched vulnerability reports.
Users can explore published vulnerabilities through the BaseFortify CVE Reports section.
Risk-Based Vulnerability Prioritization
One of the most important challenges in vulnerability management is determining which security issues require immediate attention.
A vulnerability with a high severity score is not necessarily the most likely to be exploited. Conversely, a vulnerability with a moderate severity score may represent an urgent risk when active exploitation has been confirmed.
BaseFortify supports risk-based prioritization through several complementary indicators.
CVSS: Measuring Vulnerability Severity
The Common Vulnerability Scoring System (CVSS) provides a standardized framework for describing the technical characteristics and severity of vulnerabilities.
CVSS scores range from 0.0 to 10.0, with higher scores generally indicating greater technical severity.
Factors considered by CVSS include:
- Attack vector and complexity.
- Privileges required for exploitation.
- User interaction requirements.
- Potential impacts on confidentiality, integrity, and availability.
CVSS helps security teams understand the potential technical consequences of a vulnerability, but it does not independently predict whether exploitation will occur.
EPSS: Estimating Exploitation Probability
The Exploit Prediction Scoring System (EPSS), maintained by FIRST, estimates the probability that a published CVE will be exploited in the wild within the next 30 days.
EPSS uses a data-driven model to produce probability estimates that can help organizations prioritize limited remediation resources.
For example, two vulnerabilities may have similar CVSS scores but substantially different EPSS probabilities.
Understanding this difference can help security teams identify vulnerabilities that are more likely to attract exploitation attempts.
EPSS is a predictive indicator rather than a guarantee of exploitation and should be interpreted alongside other security intelligence.
CISA KEV: Identifying Known Exploited Vulnerabilities
The CISA Known Exploited Vulnerabilities (KEV) catalog identifies vulnerabilities for which there is reliable evidence of exploitation in the wild.
Unlike CVSS, which describes technical severity, and EPSS, which estimates future exploitation probability, CISA KEV provides evidence that exploitation has already occurred.
Organizations can use this information to identify vulnerabilities that may require urgent investigation and remediation.
The absence of a vulnerability from the KEV catalog does not mean that it is safe or cannot be exploited.
Combining Multiple Risk Indicators
Effective vulnerability prioritization considers multiple factors rather than relying on a single score.
| Indicator | Primary Purpose |
|---|---|
| CVSS | Assess technical severity and potential impact. |
| EPSS | Estimate the probability of exploitation within 30 days. |
| CISA KEV | Identify vulnerabilities with confirmed exploitation in the wild. |
| Asset Context | Evaluate the importance and exposure of affected systems. |
| Vendor Guidance | Identify available patches, mitigations, and recommended actions. |
By considering these indicators together, organizations can make more informed decisions about which vulnerabilities should be addressed first.
Risk-based vulnerability prioritization combines technical severity, exploitation intelligence, and the importance of affected assets.
Canonical Naming and CPE-Based Vulnerability Matching
Accurate vulnerability matching depends on correctly identifying software vendors, products, and versions.
However, product information is frequently inconsistent across software inventories, vulnerability databases, and vendor advisories.
The same application may appear under different product names, abbreviations, editions, or vendor identifiers.
These inconsistencies can create challenges such as:
- Duplicate product records.
- Incorrect vendor identification.
- Missed vulnerability matches.
- False-positive vulnerability findings.
- Inconsistent reporting across systems.
Common Platform Enumeration (CPE)
Common Platform Enumeration (CPE) is a standardized naming system used to identify software, operating systems, and hardware products.
CPE information plays an important role in connecting published vulnerabilities to affected technologies.
BaseFortify uses CPE information as part of its vulnerability matching process.
However, identifying the correct CPE is not always straightforward. Product names may differ from official CPE entries, and vulnerability records may contain incomplete or ambiguous affected-product information.
Canonical Vendor and Product Names
To improve consistency, BaseFortify uses canonical naming to standardize vendor and product identities.
Canonical naming helps associate alternative product names with consistent identifiers, improving the interpretation of software inventories and vulnerability records.
For example, software may be identified by a commercial product name, an abbreviated name, or a vendor-specific naming convention.
Normalizing these names can improve the accuracy and consistency of vulnerability matching.
BaseFortify combines canonical naming, CPE information, and vulnerability intelligence to help reduce unnecessary duplication and improve the relevance of reported findings.
Automated matching remains dependent on the quality of available source data and may require additional verification for complex products or version ranges.
Continuous Vulnerability Monitoring
Vulnerability management is an ongoing process rather than a one-time assessment.
New vulnerabilities are disclosed regularly, while existing CVE records may receive updated information long after their initial publication.
These changes can include:
- Newly identified affected products and versions.
- Revised CVSS scores.
- Updated EPSS exploitation probabilities.
- New evidence of active exploitation.
- Additional vendor security advisories.
- New patches, workarounds, and mitigation guidance.
BaseFortify continuously processes vulnerability intelligence and supports ongoing monitoring of registered software components.
This allows organizations to identify newly relevant vulnerabilities without manually reviewing every public vulnerability database.
Notifications and vulnerability summaries help users remain informed about important changes affecting their monitored environment.
From Vulnerability Detection to Remediation
Identifying a vulnerability is only the beginning of the vulnerability management process.
Organizations must also assess whether the finding is relevant, determine its priority, implement appropriate remediation, and verify that the risk has been addressed.
A structured vulnerability management workflow typically includes:
- Identification: Detect vulnerabilities associated with monitored software and systems.
- Assessment: Review affected versions, technical severity, exploitation intelligence, and organizational context.
- Prioritization: Determine which findings require immediate attention.
- Remediation: Apply security updates, configuration changes, or other appropriate mitigations.
- Verification: Confirm that the identified vulnerability has been addressed.
- Monitoring: Continue tracking new vulnerabilities and changes to existing intelligence.
BaseFortify supports this process by providing vulnerability information, component monitoring, threat tracking, and supporting security references.
These capabilities help organizations maintain a clearer view of outstanding vulnerability risks and remediation activities.
Supporting Cybersecurity Governance and Compliance
Vulnerability management is an important component of organizational cybersecurity governance.
Security frameworks and regulatory requirements increasingly emphasize the need to identify assets, assess vulnerabilities, manage security risks, and maintain appropriate remediation processes.
BaseFortify can support organizations working with security requirements and frameworks such as:
- ISO/IEC 27001: Supporting information security risk management and technical vulnerability management processes.
- NIS2: Supporting cybersecurity risk-management activities and vulnerability handling practices.
- GDPR: Contributing to appropriate technical and organizational security measures where personal data processing is involved.
- Internal security policies: Supporting documented vulnerability monitoring, assessment, and remediation workflows.
By maintaining structured vulnerability intelligence and information about monitored components, organizations can improve their understanding of technical security exposure.
BaseFortify supports these activities but does not independently establish regulatory compliance or replace a comprehensive information security management system.
Why Continuous Vulnerability Intelligence Matters
The value of vulnerability intelligence depends on its relevance, accuracy, and timeliness.
A vulnerability that appears relatively unimportant when first published may become significantly more urgent when exploit code becomes available, exploitation activity increases, or additional affected products are identified.
Similarly, a vulnerability with a high technical severity score may represent a lower immediate priority when the affected component is not present or is not exposed in a relevant configuration.
Combining current vulnerability intelligence with an accurate software inventory enables organizations to make better-informed security decisions.
BaseFortify is designed to make this process more accessible by connecting public cybersecurity intelligence with the technologies organizations actually use.
Conclusion: A More Practical Approach to Vulnerability Management
Effective vulnerability management requires a combination of accurate asset information, reliable vulnerability intelligence, exploitation indicators, and structured remediation processes.
BaseFortify brings these elements together through CVE monitoring, CPE-based matching, canonical product naming, CVSS and EPSS scoring, known exploitation intelligence, and continuous component monitoring.
By focusing on vulnerabilities relevant to their environment, organizations can reduce unnecessary investigation and direct attention toward security issues that deserve priority.
BaseFortify helps turn complex vulnerability intelligence into clearer, more actionable security information.
Start monitoring your software components and discover vulnerabilities relevant to your organization.
