Train your team on the vulnerabilities you actually have.
The security training platform for teams, driven by your real findings: guided learning paths, knowledge-check quizzes, assignments you can verify, and a team coverage dashboard. Each finding maps through its CWE to the training that prevents it, and verified completions are logged as audit evidence for the training controls in CMMC, SOC 2, HIPAA and PCI DSS.
The intelligence layer between your scanners and your auditors: the same findings map to 13 compliance frameworks and ship as an audit-ready POAM.
Risk posture · live
Critical findings
12
KEV-listed
3
Frameworks mapped
13
Audit-ready evidence
47
Reads the scanners you already run
11
Scanner formats
Nessus, SARIF, CycloneDX, Qualys, OpenVAS, SPDX, OSV, CSAF, CSV, JSON, XLSX
13
Compliance frameworks
NIST 800-53, CMMC, SOC 2, FedRAMP, HIPAA, PCI DSS, ISO 27001 + 6 more
2
AI triage paths
Guarded cloud AI today; a private Corvus runtime is in progress
100%
Veteran-owned
Founded and run by a veteran security practitioner
How it works
From findings to trained team to audit evidence
A four-step loop: the vulnerabilities your scanners find decide what your team learns, and the training record becomes evidence your auditors can check.
Upload scan
Upload scanner results or run the free CLI in CI. Nessus, SARIF, CycloneDX, Qualys and 7 more formats ingest out of the box, enriched with EPSS, CISA KEV and CVSS.
npx @cveriskpilot/scan@latest --preset startupMap to controls
Findings that carry a CWE map to the controls they threaten across 13 frameworks. AI triage on request helps decide what to fix first, and POAMs build from the same data.
Assign targeted training
The weaknesses in your open findings decide the training. CWE-89 findings point your developers to SQL injection courses; recommendations link to external providers and free resources.
Export evidence
Track assignments and completions, verify them, and export a CSV your auditor can use as evidence for training controls next to your POAM.
The platform
Compliance mapping, triage and training in one loop.
The same findings drive the control mapping, the triage, the fixes and the training your team takes. Audit evidence comes out of one pipeline — not bolted on after.
AI Triage
Risk-based AI triage across external models today, with our private Corvus runtime in progress. Critical findings (CVSS 9 or higher), KEV-listed findings with high EPSS, and low-confidence answers escalate to larger models and human review. The model accelerates the workflow; people still make the final call.
Compliance in the Loop
Findings that carry a CWE map automatically to the controls they affect, across a 13-framework catalog of 400+ controls.
Risk Prioritization for Operators
EPSS exploit probability, CISA KEV, CVSS, and compliance impact are combined to help teams decide what to fix first instead of working from severity alone.
Evidence Workflows for Audits
POAM generation, PDF exports, and compliance evidence workflows move teams from raw findings to audit artifacts grounded in actual scan data.
Built for Lean Security Teams
Multi-tenant architecture, team workflows, and partner delivery models with enterprise controls — RBAC, a require-MFA policy, white-label branding and usage-based billing, with enterprise SSO in progress.
Product Walkthrough
See CVERiskPilot in action
A 75-second walkthrough of the sample demo workspace (recorded April 2026, before the interface redesign) — dashboard, CVE triage, compliance mapping (a sample of the 13 supported frameworks), and reports.
Recorded with sample data — AI responses in the video are pre-written examples, not live model output.
Free · Open · No signup
Scan your repo in 30 seconds with our free CLI
Detect vulnerabilities, secrets, and infrastructure-as-code drift, then map each finding that carries a CWE to NIST 800-53, SOC 2, CMMC, FedRAMP, ASVS, and SSDF controls. Runs locally with no account and no telemetry; nothing is sent to CVERiskPilot unless you add an API key. Dependency names and versions are checked against the public OSV database, CVE IDs are sent to the public FIRST EPSS API, and the CISA KEV feed is downloaded to match against. Use it standalone or as the on-ramp to the full platform.
# run once, no install
$ npx @cveriskpilot/scan@latest
# or install globally
$ npm install -g @cveriskpilot/scan@latest
$ crp-scan --preset startup
# CI/CD: pin a version, output SARIF
$ npx @cveriskpilot/scan@0.1 --format sarif > report.sarifYour CI/CD pipeline now speaks compliance
Every pull request maps vulnerabilities to NIST 800-53, SOC 2, CMMC, FedRAMP, and nine more frameworks — no spreadsheets, no quarterly mapping sprints.
Step 01
Scan
CLI, Semgrep, Trivy, or Snyk runs in your pipeline.
Step 02
Map
CWE findings route to controls across 13 frameworks.
Step 03
Triage
Auto-classify true positive, false positive, or review.
Step 04
POAM
The highest-risk findings appear in a POAM preview; full POAMs are generated in the platform.
Frameworks mapped on every scan
13 frameworks · 400+ controls · 0 spreadsheets
One CWE. Every framework that cares.
When the scanner emits CWE-89 (SQL Injection), CVERiskPilot fans it out through NIST 800-53 to the matching controls in each framework that covers it. No analyst interprets, no spreadsheet translates.
- SI-10
NIST 800-53
Information Input Validation
- CC6.8
SOC 2
Vulnerability Management
- SI.L2-3.14.1
CMMC 2.0
Flaw Remediation
- SI-2
FedRAMP
Flaw Remediation
- V5.1
OWASP ASVS
Input Validation
- Req-6.2
PCI DSS 4.0
Bespoke and Custom Software Developed Securely
Drop it into GitHub Actions
One workflow file. SARIF goes straight to the GitHub Security tab, critical findings block the merge, compliance mapping runs on every PR. Same shape works in GitLab CI, CircleCI, and Jenkins.
name: Compliance Scan
on: [pull_request]
jobs:
cveriskpilot:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npx @cveriskpilot/scan@latest \
--preset startup \
--format sarif \
--fail-on critical \
> report.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: report.sarifNo API key needed for the open-source scan (core 6 frameworks). Add an API key from any plan, Free included, to see all 13.
How we compare
CVERiskPilot complements your existing scanners — it adds the compliance layer they're missing.
| Feature | CRP | Snyk | Sonar | GHAS |
|---|---|---|---|---|
| Finds vulnerabilities | ||||
| Auto-triage (TP / FP / Review) | — | — | — | |
| Maps to NIST 800-53 | — | — | — | |
| Maps to SOC 2 / CMMC / FedRAMP | — | — | — | |
| Auto-generates POAM | — | — | — | |
| Compliance verdict in CI/CD | — | Partial | — | |
| AI fix guidance per finding | Partial | — | Partial |
What your team sees on every pull request
With the CVERiskPilot GitHub Action, a compliance-aware check is posted straight into GitHub pull request threads.
github-actions[bot] · CVERiskPilot Compliance Scan
One command. 30 seconds. Compliance mapping across 13 frameworks. Free and unlimited.
Compliance packages
Pick the audit you're preparing for
Every package turns your scanner output into control-mapped findings and an audit-ready POAM. Choose by the assessment in front of you, not by seat count.
Starter
Individual practitioners evaluating on real data
See which controls your scan findings threaten, and what your team should learn next.
- 50 AI triage calls / month
- 3 scan uploads / month
- Unlimited local CLI scans
- POAM export (CSV, JSON, XLSX)
- Training recommendations from your findings
- Community support
Audit Readiness
Small GRC and security teams preparing for a commercial audit
Walk into your SOC 2, HIPAA or PCI DSS audit with a POAM already built and training evidence tied to real findings.
- 1,000 AI triage calls / month
- Up to 5 users
- Unlimited scan uploads
- Findings mapped through their CWE to your framework controls
- POAM export (CSV, JSON, XLSX)
- Learning paths, knowledge checks and a team training dashboard
- Training assignments, completion tracking and auditor evidence export
- AI chat on your workspace data
- Jira and ServiceNow ticket push
- Email support
Federal Assessment
Defense contractors and federal suppliers handling CUI
Get to a defensible CMMC Level 2 or FedRAMP-style POAM before your assessment.
- Everything in Audit Readiness
- CMMC Level 2 self-assessment workflow and SPRS estimate
- FedRAMP-style POAM generation
- CMMC AT.L2 training evidence (3.2.1–3.2.3) via the awareness path
- Case approval workflow for risk decisions
- SSO, set up with our team
- Built by a 100% Veteran Owned company
Partner
MSSPs, vCISOs and assessment firms
Deliver compliance-mapped vulnerability reports and findings-driven training across your client base.
- Manage multiple client organizations
- Recurring commission on referred customers
- Client-ready POAMs and compliance impact reports
- Run findings-driven training paths across client organizations
- Partner onboarding with our team
All packages include unlimited local CLI scans. Run without an API key, the CLI reports the core 6 frameworks; add an API key from any package to see all 13.
Turn scanner noise into audit-ready decisions.
Start free on Starter with all 13 frameworks and POAM export, or begin a 14-day Audit Readiness trial when you need more triage volume, AI chat, and unlimited uploads.
Starter is free, no card · 14-day Audit Readiness trial · 100% Veteran Owned