White-paper
Vulnerability Management and Threat Intelligence with BaseFortify
Vulnerability management is more than a list of security weaknesses. Organizations need to know which issues affect their systems, how likely attackers are to exploit them, and what to fix first.
BaseFortify is a vulnerability management and cyber threat intelligence platform developed by Axxemble, the company behind the Base27 Information Security Management System (ISMS).
BaseFortify brings several sources together: CVE data, software inventory monitoring, CPE matching, CVSS severity scores, EPSS exploit predictions, and evidence of known attacks. This helps organizations decide where to focus.
Effective vulnerability management is not about fixing every CVE in order of severity. It is about identifying the vulnerabilities that matter most to your environment and addressing them according to risk.
This whitepaper explores the principles behind BaseFortify, including:
- Continuous CVE monitoring and vulnerability intelligence.
- Software inventory and attack surface visibility.
- Risk-based vulnerability prioritization using CVSS, EPSS, and CISA KEV.
- Canonical vendor and product naming.
- Common Platform Enumeration (CPE) matching.
- Vulnerability remediation and security monitoring.
- Supporting cybersecurity governance and compliance.
The Challenge of Modern Vulnerability Management
New vulnerabilities appear every day. They affect operating systems, applications, network devices, and software dependencies.
Public databases contain a wealth of technical detail. The difficult part is knowing which vulnerabilities matter to your organization.
Traditional tools can produce long lists of findings. Without context, it is hard to decide what to fix first.
Organizations need answers to several important questions:
- Which newly published CVEs affect our systems?
- Are the affected products and versions present in our environment?
- How severe are the vulnerabilities?
- Are attackers actively exploiting them?
- Which vulnerabilities should be prioritized for remediation?
- How can we monitor changes in vulnerability intelligence?
BaseFortify links vulnerability data to the software components an organization monitors.
How BaseFortify Supports Vulnerability Management
BaseFortify provides one place to monitor vulnerabilities. It helps users understand how those vulnerabilities may affect their registered systems and applications.
The platform draws on established sources. These include the National Vulnerability Database (NVD), the CVE ecosystem, FIRST EPSS, CISA Known Exploited Vulnerabilities (KEV), and vendor advisories.
Its principal capabilities include:
- CVE monitoring: Tracking newly disclosed vulnerabilities and updates to existing records.
- Software component monitoring: Maintaining an inventory of applications and operating systems relevant to the organization.
- Automated vulnerability matching: Connecting published vulnerabilities with registered products using standardized identifiers and product information.
- Risk prioritization: Evaluating vulnerability severity, exploitation probability, and evidence of active exploitation.
- Security notifications: Informing users about newly identified vulnerabilities affecting monitored components.
- Vulnerability analysis: Providing technical descriptions, references, and supporting intelligence to assist investigation and remediation.
Attack Surface Management and Software Inventory
Attack Surface Management (ASM) is the process of identifying, monitoring, and reducing the assets and potential entry points that attackers could exploit.
An organization's attack surface may include:
- Internet-facing websites, applications, and services.
- Servers, workstations, and operating systems.
- Network devices and security appliances.
- Cloud infrastructure and externally hosted applications.
- Third-party software and dependencies.
- Outdated or unsupported software components.
A reliable asset inventory is the starting point for effective vulnerability management.
With BaseFortify, organizations can register and monitor the software they use. This gives them a clearer view of potential exposure.
When new vulnerability data arrives, BaseFortify can match it to monitored products.
A reliable software inventory transforms general vulnerability intelligence into information that is relevant to an organization's own environment.
Component monitoring is one part of attack surface management. BaseFortify does not replace network discovery, configuration checks, or dedicated vulnerability scanners.
Understanding CVE Intelligence
The Common Vulnerabilities and Exposures (CVE) program provides standardized identifiers for publicly disclosed cybersecurity vulnerabilities.
Each CVE identifier, such as CVE-2026-12345, allows security professionals, software vendors, and vulnerability databases to refer to the same security issue consistently.
CVE IDs provide a common reference. But a CVE record alone may not tell you how much risk a vulnerability creates for your organization.
Additional intelligence may include:
- Affected vendors, products, and software versions.
- Technical vulnerability descriptions.
- CVSS severity scores.
- EPSS exploitation probabilities.
- Known exploitation indicators.
- Common Weakness Enumeration (CWE) classifications.
- Vendor advisories and remediation instructions.
- Security research and technical references.
BaseFortify brings together these sources of information to provide enriched vulnerability reports.
Users can explore published vulnerabilities through the BaseFortify CVE Reports section.
Risk-Based Vulnerability Prioritization
Not every vulnerability needs the same response. The challenge is deciding which ones need attention now.
A high severity score does not always mean an attack is likely. A moderately severe vulnerability may be more urgent if attackers are already exploiting it.
BaseFortify supports risk-based prioritization through several complementary indicators.
CVSS: Measuring Vulnerability Severity
The Common Vulnerability Scoring System (CVSS) provides a standardized framework for describing the technical characteristics and severity of vulnerabilities.
CVSS scores range from 0.0 to 10.0, with higher scores generally indicating greater technical severity.
Factors considered by CVSS include:
- Attack vector and complexity.
- Privileges required for exploitation.
- User interaction requirements.
- Potential impacts on confidentiality, integrity, and availability.
CVSS describes possible technical impact. It does not predict whether attackers will exploit a vulnerability.
EPSS: Estimating Exploitation Probability
The Exploit Prediction Scoring System (EPSS), maintained by FIRST, estimates the probability that a published CVE will be exploited in the wild within the next 30 days.
EPSS uses data to estimate exploit probability. Teams can use this estimate to focus limited time and resources.
For example, two vulnerabilities may have similar CVSS scores but substantially different EPSS probabilities.
Understanding this difference can help security teams identify vulnerabilities that are more likely to attract exploitation attempts.
EPSS is a prediction, not a guarantee. Always consider it alongside other security information.
CISA KEV: Identifying Known Exploited Vulnerabilities
The CISA Known Exploited Vulnerabilities (KEV) catalog identifies vulnerabilities for which there is reliable evidence of exploitation in the wild.
Each measure answers a different question. CVSS describes severity. EPSS estimates the chance of exploitation. CISA KEV shows where exploitation has already been observed.
Organizations can use this information to identify vulnerabilities that may require urgent investigation and remediation.
The absence of a vulnerability from the KEV catalog does not mean that it is safe or cannot be exploited.
Combining Multiple Risk Indicators
Effective vulnerability prioritization considers multiple factors rather than relying on a single score.
| Indicator | Primary Purpose |
|---|---|
| CVSS | Assess technical severity and potential impact. |
| EPSS | Estimate the probability of exploitation within 30 days. |
| CISA KEV | Identify vulnerabilities with confirmed exploitation in the wild. |
| Asset Context | Evaluate the importance and exposure of affected systems. |
| Vendor Guidance | Identify available patches, mitigations, and recommended actions. |
By considering these indicators together, organizations can make more informed decisions about which vulnerabilities should be addressed first.
Risk-based vulnerability prioritization combines technical severity, exploitation intelligence, and the importance of affected assets.
Canonical Naming and CPE-Based Vulnerability Matching
To match vulnerabilities correctly, you first need to identify the right vendors, products, and versions.
Product names often differ between software inventories, vulnerability databases, and vendor advisories.
The same application may appear under different product names, abbreviations, editions, or vendor identifiers.
These inconsistencies can create challenges such as:
- Duplicate product records.
- Incorrect vendor identification.
- Missed vulnerability matches.
- False-positive vulnerability findings.
- Inconsistent reporting across systems.
Common Platform Enumeration (CPE)
Common Platform Enumeration (CPE) is a standardized naming system used to identify software, operating systems, and hardware products.
CPE information plays an important role in connecting published vulnerabilities to affected technologies.
BaseFortify uses CPE information as part of its vulnerability matching process.
Finding the correct CPE can be difficult. Product names may differ from official CPE entries. Some vulnerability records also have missing or unclear product details.
Canonical Vendor and Product Names
To improve consistency, BaseFortify uses canonical naming to standardize vendor and product identities.
Canonical naming helps associate alternative product names with consistent identifiers, improving the interpretation of software inventories and vulnerability records.
For example, software may be identified by a commercial product name, an abbreviated name, or a vendor-specific naming convention.
Normalizing these names can improve the accuracy and consistency of vulnerability matching.
BaseFortify combines canonical naming, CPE information, and vulnerability intelligence to help reduce unnecessary duplication and improve the relevance of reported findings.
Automated matching depends on the quality of source data. Complex products and version ranges may still need manual checks.
Continuous Vulnerability Monitoring
Vulnerability management is ongoing. It is not a one-time check.
New vulnerabilities appear regularly. Existing CVE records can also change long after publication.
These changes can include:
- Newly identified affected products and versions.
- Revised CVSS scores.
- Updated EPSS exploitation probabilities.
- New evidence of active exploitation.
- Additional vendor security advisories.
- New patches, workarounds, and mitigation guidance.
BaseFortify continuously processes vulnerability intelligence and supports ongoing monitoring of registered software components.
This allows organizations to identify newly relevant vulnerabilities without manually reviewing every public vulnerability database.
Notifications and vulnerability summaries help users remain informed about important changes affecting their monitored environment.
From Vulnerability Detection to Remediation
Identifying a vulnerability is only the beginning of the vulnerability management process.
Teams must check whether a finding applies to them. Then they need to set a priority, take action, and verify the result.
A structured vulnerability management workflow typically includes:
- Identification: Detect vulnerabilities associated with monitored software and systems.
- Assessment: Review affected versions, technical severity, exploitation intelligence, and organizational context.
- Prioritization: Determine which findings require immediate attention.
- Remediation: Apply security updates, configuration changes, or other appropriate mitigations.
- Verification: Confirm that the identified vulnerability has been addressed.
- Monitoring: Continue tracking new vulnerabilities and changes to existing intelligence.
BaseFortify supports this process by providing vulnerability information, component monitoring, threat tracking, and supporting security references.
These capabilities help organizations maintain a clearer view of outstanding vulnerability risks and remediation activities.
Supporting Cybersecurity Governance and Compliance
Vulnerability management is an important component of organizational cybersecurity governance.
Security frameworks and regulations call for clear processes. Organizations need to identify assets, assess vulnerabilities, manage risks, and track fixes.
BaseFortify can support organizations working with security requirements and frameworks such as:
- ISO/IEC 27001: Supporting information security risk management and technical vulnerability management processes.
- NIS2: Supporting cybersecurity risk-management activities and vulnerability handling practices.
- GDPR: Contributing to appropriate technical and organizational security measures where personal data processing is involved.
- Internal security policies: Supporting documented vulnerability monitoring, assessment, and remediation workflows.
By maintaining structured vulnerability intelligence and information about monitored components, organizations can improve their understanding of technical security exposure.
BaseFortify can support these activities. It does not, by itself, establish compliance or replace a full information security management system.
Why Continuous Vulnerability Intelligence Matters
The value of vulnerability intelligence depends on its relevance, accuracy, and timeliness.
A vulnerability may seem minor when first published. It can become urgent if exploit code appears, attacks increase, or more affected products are identified.
A severe vulnerability may be less urgent if the affected software is not present or exposed in your environment.
Combining current vulnerability intelligence with an accurate software inventory enables organizations to make better-informed security decisions.
BaseFortify is designed to make this process more accessible by connecting public cybersecurity intelligence with the technologies organizations actually use.
Conclusion: A More Practical Approach to Vulnerability Management
Effective vulnerability management starts with accurate asset data. It also needs reliable vulnerability intelligence, signs of exploitation, and a clear process for fixing issues.
BaseFortify brings these elements together through CVE monitoring, CPE-based matching, canonical product naming, CVSS and EPSS scoring, known exploitation intelligence, and continuous component monitoring.
By focusing on vulnerabilities relevant to their environment, organizations can reduce unnecessary investigation and direct attention toward security issues that deserve priority.
BaseFortify helps turn complex vulnerability intelligence into clearer, more actionable security information.
Start monitoring your software components and discover vulnerabilities relevant to your organization.
