From first scan to audit-ready reports in minutes.

Sign up at /signup using your email address or through one of the supported OAuth providers: Google, GitHub, or Microsoft. OAuth signup is the fastest path -- one click and your account is ready.

During signup, the beta discount is applied automatically at checkout, giving you 50% off Pro during the alpha. This gives you expanded asset limits, AI triage calls, and scheduled reports at a discounted rate while the platform is in controlled alpha.

Your organization is created automatically during signup -- you provide the organization name as part of the registration flow. Once inside the platform, visit /settings to configure your workspace:

New workspaces start empty by design. If you want to see the dashboard, findings, cases, and compliance score before uploading a real scanner export, use the onboarding checklist on the dashboard and select Load sample.

Navigate to /upload and drag-and-drop your scan file or use the file browser. CVERiskPilot accepts 11 scanner formats:

After upload, parsing and enrichment happen automatically. AI triage is available through explicit request paths:

The /findings page displays all parsed vulnerabilities in a sortable, filterable table. Each row includes:

Use the filter bar to narrow results by severity, scanner source, asset, framework, or triage status. Column headers are sortable -- click any header to reorder findings by that dimension.

Findings can receive AI-assisted triage through the product's explicit chat, triage, query, summary, and remediation paths. Open any finding detail view to see available triage output:

The six recommended actions are:

You can configure the auto-approve confidence threshold in /settings under Triage Policy. Until the release gate is enabled, triage decisions remain human-review-gated before finalization.

The /compliance page shows how your vulnerabilities map to regulatory and industry frameworks. CVERiskPilot supports 13 frameworks:

Each finding is mapped to specific controls within your active frameworks. For example, an unpatched critical CVE might threaten NIST 800-53 SI-2 (Flaw Remediation), SOC 2 CC7.1 (System Monitoring), and PCI DSS 6.3.3 (Security Patches) simultaneously.

The compliance dashboard provides a posture score per framework, showing the percentage of controls that are satisfied, at risk, or failing. This is the view your auditors care about -- it answers "what will fail audit today" at a glance.

The /cases page tracks the remediation lifecycle for each finding or group of findings. Cases provide structure around the decision workflow:

Visit /reports to generate audit-ready documentation. Available report types include:

All reports can be exported as PDF. Reports include AI-generated risk narratives written in the language auditors expect -- not raw CVSS scores but contextualized business and compliance impact statements.

The /settings page provides full control over your workspace. Available configuration tabs:

For CI/CD pipeline integration, install the @cveriskpilot/scan CLI tool. The scanner runs dependency, secrets, and infrastructure-as-code checks locally and uploads results directly to the platform.

See the full CLI reference for installation, flags, framework presets, output formats, and exit codes.