The Vulners team has introduced a new AI-powered product - Cube. The platform provides contextual analysis of vulnerability scan results, correlating technical findings with information about an organization's infrastructure and business processes.

Cube is built around three core layers:

📥 Evidence Layer - collects reports from existing vulnerability scanners, including Nessus, OpenVAS, Qualys, Rapid7 InsightVM, Acunetix, and others. It processes the findings and maps them to actual infrastructure assets.

🗺️ Context Layer - enriches scan results with infrastructure data from architectural documentation, diagrams, task tracker tickets, cloud environments, and business processes. It builds a contextual model of the infrastructure, including a CMDB and network graph, helping identify affected assets, evaluate their exposure, and understand their role in business operations.

🧠 Decision Layer - uses the CISA SSVC (Stakeholder-Specific Vulnerability Categorization) methodology to prioritize remediation efforts. Unlike CVSS, which focuses on the technical severity of vulnerabilities, SSVC uses a decision tree that takes exploitation conditions and potential business impact into account.

The CISA SSVC model defines four possible decision outcomes:

🟢 Track - vulnerability remediation follows the standard Vulnerability Management process. The vulnerability is monitored and addressed according to standard software update timelines.

🟡 Track* - the vulnerability requires closer monitoring, with its assessment revisited as new information or circumstances emerge.

🟠 Attend - the vulnerability requires increased attention from security teams and relevant management. This may involve bringing in additional experts and notifying key stakeholders. Remediation should be accelerated.

🔴 Act - the vulnerability requires escalation to senior management, with response efforts coordinated across departments. A coordinated action plan is developed, the necessary stakeholders are engaged, and remediation is carried out as soon as possible.

SSVC therefore determines not only which vulnerabilities should be addressed first, but also the level of organizational response required to address them.

Cube provides users with several types of results:

🎯 Risk Cases - grouped findings accompanied by severity ratings and assessments of potential business impact.

🛤️ Attack Paths - potential attack paths between assets, aligned with the MITRE ATT&CK framework.

🛡️ Threat Profile - an overview of the threat landscape and the current state of the infrastructure.

📋 Decision Rationale - explanations of decisions, linked to the original reports, assessments, and infrastructure data.

For example, a vulnerability with a CVSS score of 9.8 on an isolated internal build server may be assigned a lower priority than a vulnerability with a CVSS score of 7.5 on a publicly accessible payment gateway. In the latter case, the potential business impact is significantly greater.

The platform is deployed within the customer's own infrastructure (on-premises) and supports any LLM with an OpenAI- or Anthropic-compatible API, including proprietary models running on the customer's GPU servers. This means Cube does not lock customers into a specific AI provider. Vulners does not charge for token usage, leaving customers in control of their LLM costs. According to Vulners, running the model in a medium-sized infrastructure costs approximately $1,000 per month.

To summarize, Cube enriches traditional Vulnerability Management by linking technical vulnerabilities to infrastructure assets, operational processes, and potential business impact.