Free tool

Scan triage and POA&M aging.

Drop in a CSV from Nessus, Tenable, Qualys, AWS Inspector, Defender for Cloud, Defender for Endpoint, or Wazuh. Get your remediation clock, how many of those rows are actually the same finding, and which hosts are carrying the program. Add last month's scan and you get the diff nobody produces by hand: what's new, what closed, what's still open.

Your scan never leaves this page. Everything runs in your browser. No upload, no server, no account, no email required. Open your network tab and watch.

This month's scan

CSV export · required

Last month's scan

optional — enables the diff

KEV / EPSS feeds

optional — ranks by real-world exploitation

Pulling fresher KEV and EPSS data — two commands

This page already carries a snapshot of both feeds, and the date it was taken is printed under the results. If that date is older than you want, or you need exact EPSS scores below the trim threshold, fetch the originals and drop them into the third box. They override everything built in.

macOS and Linux

curl -O https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
curl -O https://epss.empiricalsecurity.com/epss_scores-current.csv.gz && gunzip epss_scores-current.csv.gz

Windows PowerShell

iwr https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -OutFile kev.json
iwr https://epss.empiricalsecurity.com/epss_scores-current.csv.gz -OutFile epss.csv.gz
# then unzip epss.csv.gz with 7-Zip or Expand-Archive equivalent

Or just click: CISA KEV catalog · FIRST EPSS downloads. Drop both files in at once — the page works out which is which from the contents, not the filename.

The EPSS file is about 12 MB unzipped and covers roughly a quarter of a million CVEs. It is read in your browser like any other file here; it is not uploaded, and neither is your scan.

What the KEV and EPSS feeds do

Severity tells you how bad a vulnerability would be if someone exploited it. It does not tell you whether anyone is. These two free feeds do, and between them they are the difference between a ranked list and a wall of red.

CISA KEVThe catalog of CVEs confirmed to be exploited in the wild. A few thousand entries against a quarter of a million published CVEs — so a hit here is the strongest signal you can get for free. Federal civilian agencies are bound to remediate these on a clock under BOD 22-01. Download known_exploited_vulnerabilities.json from cisa.gov → Known Exploited Vulnerabilities Catalog.
FIRST EPSSA daily score from 0 to 1 giving the probability a CVE is exploited in the next 30 days. Useful precisely because it disagrees with CVSS — plenty of 9.8s sit under one percent, meaning severe in theory and ignored in practice. Download the daily epss_scores-YYYY-MM-DD.csv.gz from first.org/epss and unzip it.

Both files are read in your browser, exactly like your scan. This page never calls out to CISA or FIRST — if it did, your CVE list would leave your network, and a list of the vulnerabilities present in one organisation is precisely the thing worth keeping to yourself. You fetch the feeds, you drop them in, nothing is transmitted. The offline copy works the same way with the files on a USB stick.

No file handy? Run a synthetic sample.

↓ Policy won't let you upload a scan to an unfamiliar site? Good instinct. Take the offline copy instead — one HTML file, no network requests, no analytics, nothing loaded from anywhere. Save it, disconnect, open it in a browser. It works exactly the same and you can read every line of the source.
↓ Download offline copy

What to export.

Seven export formats supported. Two minutes of setup buys you a much better answer.

✓ The one field that changes everything is First Discovered. Include it and the tool computes real aging and true overdue status from a single export — no second file needed. Leave it out and you only get today's snapshot. Qualys VMDR, Tenable, Defender for Cloud and Wazuh all offer it under one name or another. Where a product has no such field, the tool falls back to a scan date it finds in the file, then the filename, then the file's last-modified time — and tells you which it used.

Tenable and Nessus

In Security Center or Vulnerability Management: Analysis → Vulnerabilities → set your filters → Export as CSV, then pick columns. In Nessus Professional: open the scan → Export → CSV and tick them in the dialog. Either way you want Plugin ID, Plugin Name, Severity, Host or IP Address, DNS Name, Protocol, Port, CVE, CVSS v3 Base Score, Synopsis, Solution, Plugin Output, and — where it exists — First Discovered and Last Observed.

Keep Plugin Output ticked even though it inflates the file. In Nessus Professional, which has no First Discovered column, it carries the scan date in plugin 19506 and that is what anchors aging. It is also the evidence text a POA&M observation needs. Export the same filter set each cycle — changing filters between exports makes the cycle-over-cycle diff meaningless.

Qualys, AWS Inspector, Defender, Wazuh

Export the default CSV from each. The tool recognises their native headers — QID and 1–5 severity from Qualys, resource IDs and uppercase severities from Inspector, device names and CVE IDs from Defender, agent names and dotted field names from Wazuh — and normalises severity to a common scale.

Qualys has three export shapes and the tool handles all of them. A vuln datalist export from VMDR is the one to use — it carries First Detected, so aging and overdue are real rather than anchored to a single scan date, and it carries Status so already-fixed and ignored findings can be excluded. Note VMDR writes one row per CVE, so a QID covering several CVEs appears several times and collapses to one finding. An asset datalist export has no findings in it and the tool will say so.

Qualys scan results work too, with limits. That export (Scans → the scan → Download → CSV) opens with a banner and scan-metadata block before the real table — the tool finds the table itself and takes the Launch Date from that block to anchor aging, since scan results carry no first-discovered field. It also drops the Ig (Information Gathered) rows, which have severity numbers but are not findings. A host or asset export from VMDR has its own header row and a First Detected column, which is better if you want real aging.

Wazuh exports agent.name, package.name, package.version, vulnerability.severity and vulnerability.id. Add vulnerability.detected_at if your version offers it — that is the discovery date and it makes aging work. There is no fixed-version field, so the fix list groups by package and shows the installed version: still a real ticket, just without the target.

! Watch the row cap. A Wazuh dashboard export stops at a fixed number of rows, so on a busy estate you get a sample rather than everything — and which agents land in it depends on sort order. The tool flags an export whose row count sits exactly on a common cap. Export per agent, or raise the limit, before comparing two files.

AWS Inspector ships a placeholder in its Remediation column — "None Provided" or "See References" on most rows. Keep Fixed in Version and Affected Packages in your export and the tool builds the real ticket list from the package fix data instead, one row per package upgrade at the highest fixed version.

Defender for Cloud exports an Azure Resource Graph shape with no plugin ID: the CVE becomes the finding identifier and the resource name becomes the asset. Keep the detected column — it is the discovery date, so aging and overdue work from a single export. Software, vendor, patchable, resource group, and subscription are all captured and carried into the download. It tells you which product it detected before it shows you anything.

! Ephemeral assets break the diff. AWS Inspector, container platforms, and autoscaling fleets issue a new identifier every time an instance is replaced, so identical findings read as closed on the old ID and new on the replacement. The tool detects low asset overlap between two exports, says so, and reports a second set of figures counting only assets present in both files. Trust those.

! Don't mix products in one comparison. Each identifies the same machine differently — instance ID, agent ID, device name, IP — so diffing across sources produces nonsense. The tool detects this and refuses rather than giving you a confident wrong number. Reconciling sources needs asset identity resolution, which is the hard part and is what the full tool does.

Scanner not listed?

Send me an export and I'll add it.

OpenVAS, Rapid7, Trivy, Nuclei, Tenable.ot, something in-house — send a sample with the findings scrubbed and I'll make it read that format. No charge, no catch; the more formats this reads the more useful it is to everyone. A header row on its own is usually enough to start.

Send a sample

Header names differ between products and versions. The tool matches on several known variants and tells you, in the results, exactly which columns it found and which it didn't — so if something is missing you'll see it rather than getting a quietly wrong number.

What it tells you.

Four things a scanner dashboard won't.

From one scan

From two scans

Doing this by hand every month?

Auto-POA&M carries the history forward so the reconciliation stops being a person's job.

See Auto-POA&M Federal & DoD work