Whitepaper
Introduction
BaseFortify is a threat intelligence and vulnerability management platform developed by Axxemble, the company behind the Base27 ISMS solution.
It helps organizations monitor vulnerabilities, assess risk, track affected products, and receive timely security intelligence. BaseFortify combines information from sources such as MITRE, the National Vulnerability Database, CISA, EPSS, and vendor advisories.
This whitepaper explains how BaseFortify:
- Collects and updates CVE information.
- Matches vulnerabilities to software and infrastructure.
- Uses CVSS and EPSS to support risk prioritization.
- Applies canonical naming and CPE data.
- Supports continuous vulnerability monitoring.
Why BaseFortify?
Organizations face a constant flow of newly published vulnerabilities. Small and medium-sized businesses often lack the time and specialist resources needed to review every advisory manually.
BaseFortify helps reduce this workload by monitoring vulnerability sources and matching relevant CVEs to the products an organization uses.
The platform provides:
- Daily CVE updates from MITRE and the National Vulnerability Database.
- Automated matching between vulnerabilities and monitored components.
- Notifications about newly identified risks.
- CVSS and EPSS scores to support prioritization.
- Links to vendor advisories, mitigation information, and external research.
CVSS indicates the technical severity of a vulnerability. EPSS estimates the probability that a vulnerability will be exploited in the near future. Reviewing both scores gives security teams a more balanced view of risk.
BaseFortify Plans
BaseFortify provides free and premium plans for organizations with different monitoring needs.
Free plan
- A watch list for up to 100 components.
- Weekly vulnerability summary reports.
- Automated vulnerability matching.
- Access to BaseFortify vulnerability intelligence.
Premium plan
- Unlimited component watch lists.
- Immediate vulnerability notifications.
- Additional vulnerability forecasting and analysis.
- Expanded monitoring and reporting features.
- Access to additional interface options, including dark mode.
Attack Surface Management
Attack Surface Management, or ASM, is the continuous process of identifying, monitoring, and reducing the systems and services that an attacker could target.
An organization’s attack surface may include:
- Internet-facing applications and services.
- Servers, workstations, and network devices.
- Cloud services and externally hosted systems.
- Software packages and third-party components.
- Unknown, outdated, or incorrectly configured assets.
Effective attack surface management depends on an accurate inventory of assets and the ability to connect those assets to current vulnerability intelligence.
BaseFortify supports this process through:
- Component and product monitoring.
- CPE-based vulnerability matching.
- Continuous updates from public security sources.
- Risk prioritization using CVSS and EPSS.
- Mitigation guidance and links to original advisories.
CVE Intelligence and Risk Prioritization
A vulnerability does not stop changing after it is first published. Additional affected products, exploit information, vendor guidance, and revised scores may appear later.
BaseFortify therefore continues to update CVE records after their initial publication. These updates may include:
- Newly identified affected software versions.
- Changes to CVSS scores or severity information.
- Updated EPSS probabilities.
- Evidence of active exploitation.
- New vendor advisories and remediation guidance.
- Additional references and technical analysis.
CVSS
The Common Vulnerability Scoring System assigns a severity score from 0.0 to 10.0. It describes characteristics such as attack complexity, required privileges, user interaction, and potential impact.
CVSS helps answer the question:
How severe is this vulnerability under the conditions described?
EPSS
The Exploit Prediction Scoring System estimates the probability that a published vulnerability will be exploited in real-world attacks.
EPSS helps answer a different question:
How likely is this vulnerability to be exploited soon?
Using CVSS and EPSS together helps organizations distinguish between vulnerabilities that are technically severe and vulnerabilities that are more likely to be exploited.
Canonical Naming and CPE Matching
One of the main challenges in vulnerability management is matching CVE records to real-world products.
Product names are not always written consistently. A vendor, operating system, or application may appear under several names across asset inventories, advisories, and vulnerability databases.
BaseFortify uses canonical naming to standardize product and vendor names. It also uses the Common Platform Enumeration format to connect monitored software with relevant vulnerability records.
This approach helps:
- Reduce duplicate product entries.
- Improve vulnerability matching.
- Reduce false positives.
- Make reports easier to understand.
- Improve consistency between the interface and the underlying data.
Identifying Windows operating-system information
Users can collect system information with PowerShell and use it to support CPE identification. For example:
Get-CimInstance Win32_OperatingSystem | ForEach-Object {
Write-Output "cpe:/o:$($_.Caption):$($_.Version):"
}The resulting value may need to be normalized before it matches an official CPE entry. BaseFortify’s canonical naming and matching processes help translate system information into consistent product records.
Continuous Monitoring
A one-time vulnerability scan provides only a snapshot. New CVEs, updated exploit information, and revised product data can appear at any time.
BaseFortify supports continuous monitoring by:
- Updating vulnerability records regularly.
- Checking monitored components against new CVEs.
- Generating alerts when relevant vulnerabilities are identified.
- Providing weekly vulnerability summaries.
- Updating risk information as CVSS and EPSS data changes.
This allows organizations to maintain awareness of newly emerging risks without repeatedly checking multiple vulnerability databases by hand.
Supporting Security and Compliance Activities
Vulnerability management is an important part of many security and compliance programmes. Organizations may need to show that they:
- Maintain an inventory of software and systems.
- Monitor relevant vulnerability information.
- Assess and prioritize identified risks.
- Track remediation and mitigation activities.
- Review security information regularly.
BaseFortify can support these activities by providing structured vulnerability records, component monitoring, alerts, reports, and links to supporting sources.
These capabilities may assist organizations working with requirements under frameworks and regulations such as NIS2, GDPR, and information security management systems. The platform does not replace legal, compliance, or risk-management advice.
Conclusion
BaseFortify brings vulnerability intelligence, component monitoring, risk scoring, and security analysis together in one platform.
It is designed to help organizations identify which vulnerabilities affect them, understand their significance, and decide which issues require attention first.
By combining CVE data with CPE matching, canonical naming, CVSS, EPSS, vendor information, and external security sources, BaseFortify provides a clearer and more manageable view of vulnerability risk.
Create a free account to begin monitoring your software components and receiving relevant vulnerability updates.
