CVERiskPilot feature reference

The top row displays four primary metrics: total findings across all uploaded scans, open cases requiring attention, the current compliance posture score (weighted across all active frameworks), and a risk trend sparkline showing posture movement over the past 30 days.

A chronological feed of the latest actions across your organization: scan uploads, triage decisions, case status changes, report generation, and integration events. Each entry links directly to the relevant resource.

Shortcut buttons for the most common workflows: upload a new scan, view untriaged findings, generate an executive report, and open the compliance posture view. These adapt based on your RBAC role — Viewers see report and dashboard links only.

The findings table supports filtering by severity (Critical, High, Medium, Low, Informational), status (Open, In Progress, Resolved, Accepted, Deferred), compliance framework, scanner source, and date range. Filters compose — applying multiple narrows the result set with AND logic. Column headers are sortable. Pagination handles large result sets without performance degradation.

Selecting a finding opens the detail panel with full context:

Select multiple findings using checkboxes to perform batch operations: assign to a team member, change status, create cases, or export the selection as CSV or PDF. Bulk actions respect RBAC — Viewer and Auditor roles cannot modify finding state.

After findings are parsed and enriched, users can invoke AI-assisted triage and remediation paths. The triage context considers CVSS base and temporal scores, EPSS exploitation probability, KEV catalog status, asset criticality and environment (production vs. staging), network reachability, and the compliance frameworks active for your organization. External AI calls run behind redaction and spend guards. The output is a priority level, a recommended action, and a confidence score.

Every triage decision includes a confidence score between 0 and 1. Your organization can configure an auto-approve threshold in Settings (default: 0.90), but automatic approval remains release-gated. It only applies after the gate is enabled and only for explicitly allowed low-risk actions. All other decisions are flagged for manual review.

Any Analyst, Admin, or Owner can override an AI triage decision from the finding detail view. Select a new priority level and action, then provide a justification. Overrides are recorded in the audit log with the original AI recommendation preserved for compliance evidence.

Configure triage behavior under Settings:

Cases follow a four-stage lifecycle: Open (created, awaiting assignment or work), In Progress (actively being remediated), Resolved (remediation applied, pending verification), and Closed (verified and archived). Status transitions are logged in the audit trail.

Cases can be assigned to any team member with Analyst, Admin, or Owner role. The assignee receives email and in-app notifications. Unassigned cases appear in the team queue. Ownership can be transferred at any stage.

Cases created from high-confidence AI triage decisions remain human-review-gated unless the release-gated auto-approve control is enabled for the specific recommended action. Cases requiring human review enter a pending state until an Admin or Owner approves the triage recommendation. Risk acceptance cases always require explicit human approval regardless of confidence score.

Each case has a threaded comment stream for team discussion. Comments support plain text and are timestamped with the author. Use comments to document investigation findings, remediation steps, and approval rationale.

Attach evidence files (screenshots, configuration exports, scan diffs) directly to a case. Attached evidence is included in compliance evidence packages and audit exports. All attachments are stored with AES-256-GCM encryption at rest.

Each finding is mapped to compliance controls through a CWE-based bridge. The platform resolves CVE → CWE → compliance control relationships automatically. For example, a SQL injection finding (CWE-89) maps to NIST 800-53 SI-10 (Information Input Validation), SOC 2 CC6.1, PCI DSS 6.5.1, and OWASP ASVS V5. The compliance detail view shows exactly which controls are threatened by open findings.

The compliance posture score is a weighted percentage reflecting how well your organization's current vulnerability state aligns with each framework's control requirements. The score accounts for finding severity, asset criticality, remediation status, and whether compensating controls are documented. Scores are computed per framework and rolled up into an aggregate posture score displayed on the dashboard.

Generate a Plan of Action and Milestones (POAM) document directly from open findings. The POAM includes finding description, affected controls, planned remediation date, responsible party, and estimated completion timeline. POAMs can be exported as PDF or CSV for submission to auditors or authorizing officials.

The platform collects and organizes audit evidence automatically: triage decisions, remediation timelines, approval records, scan history, and posture score trends. Export a complete evidence package per framework for audit engagements. All evidence entries are cryptographically signed via the Vault Protocol.

All reports can be exported as PDF (formatted with professional layout suitable for audit submission) or CSV (raw data for spreadsheet analysis and further processing). PDF reports include the organization name, generation timestamp, and page numbering.

Every upload passes through a four-stage pipeline:

For automated ingestion, configure direct connectors to your scanner platforms. Connectors poll for new scan results on a configurable schedule and feed them through the same processing pipeline.

The crp-scan CLI runs dependency, secrets, and IaC scans directly in your CI/CD pipeline. Results are uploaded to CVERiskPilot automatically with your API key. See the pipeline docs and GitHub Action for integration guides.

Set your organization name, industry vertical, and primary compliance frameworks. The industry setting influences AI prompt context and compliance weighting (a healthcare organization sees HIPAA-weighted guidance, for example). The selected frameworks determine which compliance controls appear in findings and reports.

Invite team members by email. Each member is assigned one of five roles:

View your current plan, usage metrics (assets, AI calls, team seats), and billing history. Upgrade or downgrade between Free, Pro, and Enterprise tiers. Manage payment methods and download invoices. The billing page connects directly to the Stripe customer portal.

Generate and manage API keys for CLI uploads, scanner connectors, and programmatic access. Keys are scoped to your organization and can be rotated or revoked at any time. Use the API key console for detailed key management.

Create Jira tickets directly from findings or cases. Configure the target project, issue type, priority mapping, and custom fields. Ticket status syncs bidirectionally — resolving a ticket in Jira updates the case status in CVERiskPilot.

Create ServiceNow incidents or change requests from cases. Supports CMDB asset mapping and assignment group routing. Available on Enterprise and MSSP tiers.

Receive real-time event notifications via webhooks. Events are delivered in CloudEvents format with HMAC-SHA256 signature verification. Supported events include: finding created, triage completed, case status changed, scan completed, and SLA breached. Failed deliveries are retried with exponential backoff. See the webhook docs for payload schemas and verification examples.

The CVERiskPilot REST API provides programmatic access to findings, cases, compliance data, and reports. Authenticate with your organization API key. Full API documentation is available at Developers.

The audit log captures all significant platform actions: login attempts, scan uploads, triage decisions (including AI and human), case status changes, role assignments, settings modifications, API key operations, and data exports. Each entry records the actor, timestamp, action type, affected resource, and metadata.

Audit log entries are protected by the Vault Protocol, a cryptographic integrity system. Each entry is signed with an Ed25519 digital signature and chained into a Merkle tree. This makes the log tamper-evident: any modification, deletion, or reordering of entries invalidates the tree and is detectable during verification. The Vault Protocol provides auditors with mathematical proof that the activity record has not been altered.

Filter audit log entries by action type, user, date range, and affected resource. The Auditor role has full read access to the audit log without the ability to modify any platform data — designed for external auditors performing evidence review.