The intelligence layer between your scanners and your auditors.
Every finding mapped to 13 compliance frameworks, classified by a purpose-built AI triage model, and shipped as audit-ready POAMs and evidence — in minutes, not weeks.
No credit card required · 14-day trial · Cancel anytime
Dashboard
Critical findings
12
KEV-listed
3
Frameworks mapped
13
Audit-ready evidence
47
11
Scanner formats
Nessus, SARIF, CycloneDX, Qualys, OpenVAS, SPDX, OSV, CSAF, CSV, JSON, XLSX
13
Compliance frameworks
NIST 800-53, CMMC, SOC 2, FedRAMP, HIPAA, PCI DSS, ISO 27001 + 6 more
3
AI deployment roadmap
Guarded cloud AI today; private cloud and air-gapped Corvus paths next
100%
Veteran-owned
SDVOSB-eligible for defense and government contracts
Live Walkthrough
See CVERiskPilot in action
A 90-second tour of the live workspace — dashboard, CVE triage with model-routed AI, compliance mapping across 13 frameworks, and audit-ready reports. No mockups, no stock footage.
Recorded against the live demo workspace — AI responses are tagged with the model path that generated them.
Purpose-built AI for triage. Compliance in the loop.
A fine-tuned model handles the volume. Frontier AI handles the edge cases. Compliance mapping and audit evidence are built into the same pipeline — not bolted on after.
AI Triage
Powered by Corvus, our private vulnerability triage runtime. Routine findings can be classified locally when Corvus is enabled, while critical, KEV-listed, or low-confidence cases escalate to external AI and human review. The model accelerates the workflow; people still make the final call.
Hybrid AI Routing
Routine findings use the private Corvus path when available. Complex edge cases auto-escalate to an external AI fallback, with deterministic safety floors for KEV, high-CVSS, and high-EPSS findings so high-risk issues do not get under-ranked silently.
Compliance in the Loop
Findings map through CWE into the 13-framework catalog: NIST 800-53, SOC 2, CMMC, FedRAMP, HIPAA, PCI-DSS, ISO 27001, NIST CSF, EU CRA, NIS2, ASVS, GDPR, and SSDF. 300+ controls mapped automatically.
Risk Prioritization for Operators
EPSS exploit probability, CISA KEV, CVSS, and compliance impact are combined to help teams decide what to fix first instead of working from severity alone.
Evidence Workflows for Audits
POAM generation, PDF exports, and compliance evidence workflows move teams from raw findings to audit artifacts grounded in actual scan data.
Built for Lean Security Teams
Multi-tenant architecture, team workflows, and partner delivery models with enterprise controls — SSO, RBAC, white-label, and usage-based billing.
Pipeline Compliance Scanner
Run the scanner locally or in CI to identify issues, feed the AI-first triage workflow, map compliance impact, and push evidence into the broader review pipeline.
Free · Open · No signup
Scan your repo in 30 seconds with our free CLI
Detect vulnerabilities, secrets, and infrastructure-as-code drift, then auto-map every finding to NIST 800-53, SOC 2, CMMC, FedRAMP, ASVS, and SSDF controls. Runs locally. No account, no telemetry, no upload. Use it standalone or as the on-ramp to the full platform.
# run once, no install
$ npx @cveriskpilot/scan@latest
# or install globally
$ npm install -g @cveriskpilot/scan@latest
$ crp-scan --preset startup
# CI/CD: pin a version, output SARIF
$ npx @cveriskpilot/scan@0.1 --format sarif > report.sarifYour CI/CD pipeline now speaks compliance
Every pull request maps vulnerabilities to NIST 800-53, SOC 2, CMMC, FedRAMP, and nine more frameworks — no spreadsheets, no quarterly mapping sprints.
Step 01
Scan
CLI, Semgrep, Trivy, or Snyk runs in your pipeline.
Step 02
Map
CWE findings route to controls across 13 frameworks.
Step 03
Triage
Auto-classify true positive, false positive, or review.
Step 04
POAM
Critical findings emit auditor-ready POAM entries.
Frameworks mapped on every scan
13 frameworks · 270+ controls · 0 spreadsheets
One CWE. Every framework that cares.
When the scanner emits CWE-89 (SQL Injection), CVERiskPilot fans it out to the exact control language each auditor wants to see. No analyst interprets, no spreadsheet translates.
- SI-10
NIST 800-53
Information Input Validation
- CC6.1
SOC 2
Logical Access Controls
- SI.L2-3.14.1
CMMC 2.0
Flaw Remediation
- SI-10
FedRAMP
Information Input Validation
- V5.3.4
OWASP ASVS
Output Encoding & Injection Prevention
- 6.2.4
PCI DSS 4.0
Bespoke Software Engineering Practices
Drop it into GitHub Actions
One workflow file. SARIF goes straight to the GitHub Security tab, critical findings block the merge, compliance mapping runs on every PR. Same shape works in GitLab CI, CircleCI, and Jenkins.
name: Compliance Scan
on: [pull_request]
jobs:
cveriskpilot:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npx @cveriskpilot/scan@latest \
--preset startup \
--format sarif \
--fail-on critical \
> report.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: report.sarifNo API key required for the open-source scan · upgrade for enterprise frameworks & AI triage.
How we compare
CVERiskPilot complements your existing scanners — it adds the compliance layer they're missing.
| Feature | CRP | Snyk | Sonar | GHAS |
|---|---|---|---|---|
| Finds vulnerabilities | ||||
| Auto-triage (TP / FP / Review) | — | — | — | |
| Maps to NIST 800-53 | — | — | — | |
| Maps to SOC 2 / CMMC / FedRAMP | — | — | — | |
| Auto-generates POAM | — | — | — | |
| Compliance verdict in CI/CD | — | Partial | — | |
| AI fix guidance per finding | Partial | — | Partial |
What your team sees on every pull request
A compliance-aware check, posted straight into GitHub and GitLab PR threads.
github-actions[bot] · CVERiskPilot Compliance Scan
One command. 30 seconds. Compliance mapping across 13 frameworks. Free and unlimited.
Pricing
AI-powered vulnerability intelligence at every scale
Start free with 25 AI chatbot messages and 50 triage calls per month. Start a Pro trial when you need more volume, more frameworks, and export-ready workflows.
Free
Try AI triage on your real scan data. Limited usage, no credit card.
- 25 AI chatbot messages / month
- 50 AI triage calls / month
- Unlimited local CLI scans
- 1 workspace, 1 user
- Core 6 compliance frameworks
- Community support
Pro
Full AI triage pipeline for individual practitioners, with a 14-day trial before your first bill.
- Unlimited AI chatbot messages
- 1,000 AI triage calls / month
- All 13 compliance frameworks
- AI hybrid routing
- POAM generation + PDF export
- Scheduled reports
- Email support
Compare plans
Every plan includes the AI chatbot, triage API, and CLI scanner.
| Feature | Free | Pro |
|---|---|---|
| AI chatbot messages | 25 / mo | Unlimited |
| AI triage calls | 50 / mo | 1,000 / mo |
| Compliance frameworks | 6 | 13 |
| AI hybrid routing | ||
| Workspace users | 1 | 1 |
| Assets | 50 | 500 |
| Scheduled reports | ||
| POAM + PDF export |
All plans include unlimited local CLI scans. Free is the easiest starting point, and Pro is the active paid conversion path with a 14-day trial.
Turn scanner noise into audit-ready decisions
Start free, or begin a 14-day Pro trial when you need more triage volume, all 13 frameworks, and export-ready evidence workflows.
No credit card required · 14-day trial · 100% Veteran Owned · SDVOSB-Eligible