Threat intelligence, applied to every finding.
Starkhound matches every finding against known real-world exploitation and the actors that use its techniques, and alerts when something changes.
Real threat, not theoretical, on every finding.
The signals come from public catalogs and from the techniques the team declares, and are reviewed every night.
Known active exploitation
Findings whose CVE is in the CISA KEV catalog are flagged and move up in priority, even more if it is used in ransomware campaigns.
Public exploits
Findings with a published exploit are flagged: a weaker signal than active exploitation, which also weighs on priority.
Alert when it changes
If the CVE of an open finding enters the catalog or an exploit appears, the project lead gets an alert, one per project.
Threat actors
The MITRE ATT&CK groups that use the techniques declared in the findings, with the matches and the affected assets.
Exploitation window
How many days each exploited vulnerability has been open, against the deadline CISA sets to fix it.
In the client portal too
The client sees which of its vulnerabilities are being exploited today and which are past their deadline.
Real exploitation and threat actors, on every finding.
Public threat intelligence, applied to every assessment.