From first scan to audit-ready reports in minutes.

Sign up at /signup using your email address or through one of the supported OAuth providers: Google or GitHub. OAuth signup is the fastest path -- one click and your account is ready.

Starter is free and needs no credit card. If you choose Audit Readiness, signup starts a 14-day trial through Stripe Checkout. Audit Readiness raises AI triage to 1,000 calls a month, adds AI chat on your workspace data, removes the monthly upload limit, and includes email support. Every plan maps findings to all 13 frameworks during the alpha and exports POAMs.

Your organization is created automatically during signup -- you provide the organization name as part of the registration flow. Once inside the platform, visit /settings to configure your workspace:

New workspaces start empty by design. If you want to see the dashboard, findings, cases, and compliance score before uploading a real scanner export, use the onboarding checklist on the dashboard and select Load sample.

Navigate to /upload and drag-and-drop your scan file or use the file browser. CVERiskPilot accepts 11 scanner formats:

After upload, parsing and enrichment happen automatically. AI triage is available through explicit request paths:

The /findings page displays all parsed vulnerabilities in a sortable, filterable table. Each row includes:

Use the filter bar to narrow results by severity, scanner source, KEV listing, EPSS threshold, or case status, or search by text. The Detected and Scanner column headers are sortable -- click either to reorder findings by discovery date or scanner.

Findings can receive AI-assisted triage through the product's explicit chat, triage, query, summary, and remediation paths. Open any finding detail view to see available triage output:

The six recommended actions are:

You can configure the auto-approve confidence threshold in /settings under Triage Policy. Until the release gate is enabled, triage decisions remain human-review-gated before finalization.

The /compliance page shows how your vulnerabilities map to regulatory and industry frameworks. CVERiskPilot supports 13 frameworks:

Each finding that carries a CWE identifier covered by the mapping is linked through NIST 800-53 to related controls in the other frameworks. For example, a SQL injection finding tagged CWE-89 threatens NIST 800-53 SI-10 (Information Input Validation), SOC 2 CC6.8 (Vulnerability Management), and PCI DSS Req-6.2 (Bespoke and Custom Software Developed Securely), among other controls. A finding without a mapped CWE is not linked to any control.

The compliance dashboard provides a posture score per framework, showing the percentage of controls that are satisfied, at risk, or failing. This is the view your auditors care about -- it answers "what will fail audit today" at a glance.

The /cases page tracks the remediation lifecycle for each finding or group of findings. Cases provide structure around the decision workflow:

Visit /reports to generate audit-ready documentation. Available report types include:

The executive summary previews in the browser and downloads as PDF. From the same dialog you can generate an optional AI-written narrative of posture, top risks, and recommended actions, framed as plain-language business risk rather than raw CVSS scores; it appears in the dialog for review, and the PDF uses the report's deterministic metrics either way. Scan comparisons export as CSV.

The /settings page provides full control over your workspace. Available configuration tabs:

For CI/CD pipeline integration, install the @cveriskpilot/scan CLI tool. The scanner runs dependency, secrets, and infrastructure-as-code checks locally and uploads results directly to the platform.

See the full CLI reference for installation, flags, framework presets, output formats, and exit codes.