Guarded AI today. Private-runtime path next.
CVERiskPilot combines vulnerability enrichment, compliance mapping, guarded external AI, human review, and the Corvus private-runtime roadmap. The current production path is explicit-request AI, with a daily spend guard on Claude and NIM calls; private runtime serving ships only after health checks and benchmark gates pass.
Model Versions
Built iteratively. Measured rigorously.
Each model version trains on more data, evaluates against held-out and golden checks, and stays out of production until serving, health, and quality gates are real.
- Training Data
- Thousands of labeled examples from open-source vulnerability data
- Infrastructure
- GPU training infrastructure
- Deployment
- Internal evaluation artifact
Established baseline metrics; not a production-serving endpoint.
- Training Data
- Tens of thousands of labeled examples across multiple training batches
- Infrastructure
- Enterprise GPU infrastructure
- Deployment
- Private-runtime path under release gates
Runtime artifact and model claims stay gated by smoke and golden benchmark evidence.
- Training Data
- Expanded dataset with human-validated labels from production feedback loops
- Infrastructure
- Enterprise GPU infrastructure
- Deployment
- Private cloud + on-premise evaluation path
Sector-specific fine-tuning (healthcare/HIPAA, defense/CMMC, fintech/PCI DSS).
Training Pipeline
Six phases. Real data. No shortcuts.
Every training example starts with a real CVE from a real repository. Enrichment, triage labels, and compliance mappings are generated programmatically — then validated.
Scan
Automated vulnerability data collection runs dependency audits across multiple package manager formats. Raw findings are deduplicated and normalized.
Continuous collection
Enrich
Each CVE is enriched with NVD severity data, EPSS exploit probability scores, and KEV catalog status. Asset context and CWE classifications are attached.
Multi-signal enrichment
Triage
AI-assisted review generates structured triage decisions: priority level, recommended action, reasoning, compliance impact, and confidence score. Reviewed outputs can become future training and evaluation labels.
Structured labels
Map
Every finding with a mapped CWE is linked to the compliance controls it affects across 13 frameworks. CWE-to-control mappings connect technical weaknesses to audit requirements.
13 frameworks
Train
Parameter-efficient fine-tuning remains the Corvus roadmap path. Training runs and runtime artifacts are gated by repo-tracked smoke and benchmark checks before buyer-facing claims are promoted.
Release-gated
Evaluate
Golden sets and smoke checks measure control citation, triage agreement, latency, and failure modes before a private runtime can serve customer traffic.
Rigorous evaluation
Why this matters
Architecture
Hybrid routing. Not a single point of failure.
Production requests use explicit, guarded AI paths today. The private Corvus path is designed to handle routine findings once it is enabled, healthy, and benchmark-gated. Every decision path is designed for confidence scoring and auditability.
CVE Ingest
Scanner findings + NVD/EPSS/KEV enrichment
PII Redaction
7 pattern categories stripped from triage and remediation prompts
Routing Engine
Severity, EPSS, KEV status, confidence threshold
Private Path (in progress)
Corvus Runtime
Routine cases use an external model today
Escalation Path
Advanced AI
Deep analysis, high stakes
Structured Triage Decision
Priority + action + reasoning + confidence + compliance mapping
Hybrid Routing
Routine triage runs on a fast external model today; the private Corvus runtime will take routine cases once it serves at interactive speed. Complex cases (critical severity, KEV-listed, high EPSS, or low confidence) escalate to larger models and human review.
Routing is driven by severity, exploit signals, and confidence rather than a fixed public percentage. Each triage answer carries a confidence score, and answers below the threshold escalate to a larger model automatically. Fail-closed: no silent degradation.
PII Redaction Pipeline
IP addresses, hostnames, URLs, usernames, AWS account IDs, and API keys are stripped from triage and remediation prompts before they reach an AI model. AI chat answers from your stored case titles and asset names.
Regex-based redaction engine with 7 pattern categories. Local redaction map retained for re-identification in results.
Confidence-Based Escalation
Every triage decision includes a confidence score. Low-confidence outputs are automatically flagged for human review or escalated to a more capable model. No silent failures.
Auto-approve threshold for high-confidence routine cases. Human-review queue for edge cases. Full audit trail of routing decisions.
Tenant-Isolated Feedback
Human corrections (severity overrides, false positive flags, action changes) are added to future triage prompts for your organization, so suggestions reflect your team's past decisions.
Feedback loop activates after 10+ human reviews to prevent noise from skewing early decisions. Organization-scoped at the database layer.
Sample Output
Example answers (sample workspace)
Pre-written example replies from the demo workspace, which runs on sample data. They illustrate how CVERiskPilot triage weighs KEV status, exploitation signals, and exposure, not raw CVSS scores alone. No model generated these answers.
You
Which findings are KEV-listed?
CVERiskPilot AI
SampleThe KEV-listed set includes XZ Utils, CitrixBleed, MOVEit Transfer, and PAN-OS command injection. Patch those first because they combine active exploitation signals with high operational impact.
You
What should the team do after the KEV items?
CVERiskPilot AI
SampleAfter the KEV items, focus on internet-exposed high-severity systems and remote access paths. In this workspace, that means validating the regreSSHion exposure next and then clearing any remaining externally reachable infrastructure findings.
Try these prompts in the demo workspace — its chat replies are pre-written examples, not live model output.
Deployment
Your infrastructure. Your rules.
Three deployment models, staged honestly: guarded cloud AI is live today; private cloud and air-gapped paths are the Corvus serving roadmap.
Cloud API
Guarded external AI via encrypted API. Triage and remediation prompts are redacted, and Claude and NIM calls are capped by a daily spend guard.
Private Cloud (VPC)
Planned private-runtime deployment inside your cloud tenant. Designed for customers that need a stricter data boundary.
On-Premise (Air-Gapped)
Corvus private-runtime roadmap for future air-gapped triage. Requires serving infrastructure and benchmark gates before production use.
AI data handling mapped to SOC 2 CC6.1 (logical access), FedRAMP AC-4 (information flow), NIST 800-53 SI-19 (de-identification), and CMMC AC.L2-3.1.3 (CUI flow control).
AI Roadmap
Where we are. Where we're going.
Model v2 — Expanded Dataset + Cloud Training
Expanded labeled examples and iterative training runs. Runtime claims remain gated by smoke tests and golden benchmark evidence.
Private Runtime Release Gate
Prepare Corvus serving infrastructure, health checks, benchmark gates, and rollback criteria before any on-prem or private-cloud deployment.
Sector-Specific Models
Healthcare (HIPAA-weighted), defense (CMMC/FedRAMP-weighted), fintech (PCI DSS-weighted) fine-tunes.
Private Triage API
Benchmark-gated private triage endpoint for CI/CD integrations where customers need a stricter data boundary.
Continuous Learning
Automated retraining pipeline triggered by feedback volume thresholds. Per-tenant model adapters.
See the model in action.
Upload a scan, triage cases with AI, and see which compliance controls are affected — in minutes, not days.