{"id":51345280,"url":"https://github.com/patchvex/vulnpilot","last_synced_at":"2026-07-02T11:02:00.982Z","repository":{"id":368700432,"uuid":"1285281578","full_name":"PatchVex/vulnpilot","owner":"PatchVex","description":"Turn vulnerability scan data into prioritized action. Runs locally. Your data never leaves your machine.","archived":false,"fork":false,"pushed_at":"2026-07-01T20:20:39.000Z","size":2792,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-01T21:17:24.766Z","etag":null,"topics":["cisa","cli","devsecops","epss","kev","nessus","prioritization","python","security-tools","vulnerability-management"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PatchVex.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-30T16:43:36.000Z","updated_at":"2026-07-01T20:20:44.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/PatchVex/vulnpilot","commit_stats":null,"previous_names":["patchvex/vulnpilot"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/PatchVex/vulnpilot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PatchVex%2Fvulnpilot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PatchVex%2Fvulnpilot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PatchVex%2Fvulnpilot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PatchVex%2Fvulnpilot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PatchVex","download_url":"https://codeload.github.com/PatchVex/vulnpilot/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PatchVex%2Fvulnpilot/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35043938,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-02T02:00:06.368Z","response_time":173,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cisa","cli","devsecops","epss","kev","nessus","prioritization","python","security-tools","vulnerability-management"],"created_at":"2026-07-02T11:02:00.062Z","updated_at":"2026-07-02T11:02:00.959Z","avatar_url":"https://github.com/PatchVex.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VulnPilot\n\n**Prioritize vulnerabilities using real-world exploit intelligence — not just severity scores.**\n\nRuns locally. Your data never leaves your machine.\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://github.com/PatchVex/vulnpilot/blob/main/LICENSE)\n[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://python.org)\n[![PyPI version](https://img.shields.io/pypi/v/vulnpilot.svg)](https://pypi.org/project/vulnpilot/)\n[![Status: Community Preview](https://img.shields.io/badge/status-community%20preview-orange.svg)]()\n\n---\n\n## Quick Start\n\n```bash\npip install vulnpilot\nvulnpilot update-feeds\nvulnpilot analyze scan.csv\n```\n\nVulnPilot downloads the latest public threat intelligence, analyzes your Nessus scan locally, and shows what should be remediated first. No API keys required.\n\n**Docs:** [Quick Start](docs/quickstart.md) · [Evidence Packs](docs/evidence-packs.md) · [Scoring](docs/scoring.md) · [FAQ](docs/faq.md)\n\n---\n\n## The problem\n\nSecurity teams often spend hours manually triaging scan results. Your Nessus export contains thousands of findings. CVSS says hundreds are Critical. The real question — which ones are actively being exploited right now?\n\nAnd when the audit comes — SOC 2, ISO 27001, HIPAA, DPDP — the question changes: *can you prove how you prioritize and remediate?*\n\nVulnPilot answers both, in seconds, using real-world exploit data.\n\n---\n\n## Why VulnPilot?\n\n| Instead of | VulnPilot |\n|---|---|\n| Sorting by CVSS score alone | KEV + EPSS + CVSS composite scoring |\n| Manual triage taking hours | Automated prioritization in seconds |\n| Scrambling for audit evidence | One-command audit evidence pack |\n| Uploading scans to cloud services | Local-first — data never leaves your machine |\n| Enterprise-only platforms | Community Preview — free and open source |\n\n---\n\n## How it works\n\n```\nvulnpilot analyze scan.csv\n```\n\nOutput:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  VulnPilot by PatchVex — Vulnerability Prioritization\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  Total findings        : 5,482\n  Unique hosts          : 47\n  Critical              : 142\n  KEV matches           : 19\n  EPSS \u003e= 90%           : 31\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  #    Score   Priority      Host              CVE                Finding\n  ───────────────────────────────────────────────────────────────────────\n  1    100.0   CRITICAL NOW  192.168.1.10      CVE-2021-44228     Log4Shell ★KEV\n  2    100.0   CRITICAL NOW  192.168.1.25      CVE-2023-34362     MOVEit SQL Injection ★KEV\n  3    99.8    CRITICAL NOW  192.168.1.15      CVE-2020-1472      Zerologon ★KEV\n  4    99.7    CRITICAL NOW  192.168.1.11      CVE-2021-26084     Confluence RCE ★KEV\n  5    11.5    LOW           192.168.1.10      N/A                SSH Weak Ciphers\n\n  ★ KEV = CISA Known Exploited Vulnerability — highest remediation priority\n        based on active exploitation in the wild.\n```\n\nVulnPilot cross-references your findings against three data sources — all processed locally:\n\n| Source | What it tells you |\n|---|---|\n| **CISA KEV** | Confirmed exploited in the wild right now |\n| **FIRST EPSS** | Probability of exploitation in next 30 days |\n| **CVSS** | Severity context and baseline scoring |\n\n**Composite score = KEV (40%) + EPSS (35%) + CVSS (15%) + Severity (10%)**\n\n---\n\n## Audit Evidence Pack — NEW in v0.3.0\n\nAuditors across SOC 2 (CC7.1), ISO 27001 (A.8.8), HIPAA and DPDP all ask for the same thing: proof of a documented, risk-based vulnerability management process. The most common audit gap is showing thousands of findings with no evidence of how they are prioritized.\n\nVulnPilot generates that evidence in one command:\n\n```bash\nvulnpilot analyze scan.csv --evidence soc2\n```\n\nThe evidence pack includes:\n- Scan metadata — timestamped, with source file reference\n- The documented prioritization methodology (KEV / EPSS / CVSS weights)\n- Prioritized findings with KEV flags\n- SOC 2 CC7.1 control mapping statement\n- Management review and sign-off block\n\nOutput is a clean Markdown file — convert to PDF with your tool of choice and hand it to your auditor.\n\n**Currently supported:** SOC 2 (CC7.1). ISO 27001, DPDP, and HIPAA packs are next on the roadmap.\n\n---\n\n## Local Scan History — NEW in v0.3.0\n\nEvery analysis run is automatically recorded to a local SQLite database at `~/.vulnpilot/history.db` — on your machine only, never transmitted.\n\nWhy this matters: SOC 2 Type II audits require evidence that your process operated consistently over a 6–12 month observation period. That history cannot be recreated retroactively. VulnPilot starts building your evidence trail from your very first scan.\n\nUpcoming releases use this history for remediation verification (`vulnpilot verify`) and trend reporting.\n\n---\n\n## Why local-first?\n\nMany organizations prohibit uploading vulnerability scan data to third-party cloud services. VulnPilot performs all analysis locally on your machine.\n\n```\n        Public Threat Intelligence\n    +-------------------------------+\n    |  CISA KEV      FIRST EPSS     |\n    +---------------+---------------+\n                    |\n            vulnpilot update-feeds\n                    |\n        ~/.vulnpilot/feeds/ (local cache)\n                    |\n            vulnpilot analyze\n                    |\n    Nessus CSV (Local Machine Only)\n                    |\n       Composite Risk Engine\n                    |\n    Prioritized Findings + Evidence Pack\n```\n\nOnly public threat intelligence feeds are downloaded. No API keys required. Your scan data never leaves your machine.\n\n**Docs:** [Quick Start](docs/quickstart.md) · [Evidence Packs](docs/evidence-packs.md) · [Scoring](docs/scoring.md) · [FAQ](docs/faq.md)\n\n---\n\n## Install\n\n```bash\npip install vulnpilot\n```\n\nTested on Python 3.10, 3.11, and 3.12.\n\n---\n\n## Usage\n\n```bash\n# Download latest KEV and EPSS feeds\nvulnpilot update-feeds\n\n# Analyze a Nessus CSV export\nvulnpilot analyze scan.csv\n\n# Generate a SOC 2 audit evidence pack\nvulnpilot analyze scan.csv --evidence soc2\n\n# Verify remediation against your previous scan\nvulnpilot verify new_scan.csv\n\n# Posture trend across all recorded scans\nvulnpilot trend\n\n# Evidence pack with custom output path\nvulnpilot analyze scan.csv --evidence soc2 --evidence-out q3_evidence.md\n\n# Export HTML report\nvulnpilot analyze scan.csv --html report.html\n\n# Show top N hosts by aggregate risk\nvulnpilot analyze scan.csv --top-hosts 5\n\n# Use local feed files\nvulnpilot analyze scan.csv --kev ./kev.json --epss ./epss.csv.gz\n\n# Disable colour output (for CI pipelines)\nvulnpilot --no-colour analyze scan.csv\n```\n\n---\n\n## HTML Report\n\nGenerate a shareable, self-contained HTML report:\n\n```bash\nvulnpilot analyze scan.csv --html report.html\n```\n\nThe report includes:\n- Executive summary with KEV and EPSS highlights\n- Prioritized findings table with colour-coded risk scores\n- Top 10 hosts by aggregate risk with visual score bars\n\n---\n\n## How scoring works\n\nThe scoring algorithm is deterministic, transparent, and fully documented.\n\n| Signal | Weight | Source |\n|---|---|---|\n| CISA KEV match | 40% | Known exploited in the wild |\n| FIRST EPSS score | 35% | Exploitation probability |\n| CVSS base score | 15% | Severity context |\n| Scanner risk rating | 10% | Nessus severity label |\n\nThe composite score is intentionally opinionated. Known exploited vulnerabilities receive the greatest weight because active exploitation is a stronger predictor of remediation priority than severity alone. Any KEV finding scores a minimum of 75 regardless of other factors.\n\nThe weighting model is intentionally transparent and may evolve based on community feedback and real-world usage.\n\n\u003e **Note**\n\u003e\n\u003e VulnPilot provides prioritization guidance to assist remediation workflows.\n\u003e Final remediation decisions should always consider asset criticality, business context,\n\u003e exploit mitigations, and organizational risk tolerance.\n\n---\n\n## Privacy by design\n\n- Scan data processed entirely on your local machine\n- No account required\n- No cloud upload, ever\n- No telemetry or analytics\n- No API keys required\n- Works air-gapped after initial feed download\n- Scan history stored locally at `~/.vulnpilot/history.db` — your machine only, delete it anytime\n- Open source — inspect every line of code\n\n---\n\n## Feed updates\n\nVulnPilot pulls two public datasets:\n\n- **CISA KEV** — Known Exploited Vulnerabilities catalog (maintained by CISA)\n- **FIRST EPSS** — Exploit Prediction Scoring System (updated daily by FIRST.org)\n\nFeeds are cached at `~/.vulnpilot/feeds/` on your machine. No API keys required.\n\n**Docs:** [Quick Start](docs/quickstart.md) · [Evidence Packs](docs/evidence-packs.md) · [Scoring](docs/scoring.md) · [FAQ](docs/faq.md)\n\n```bash\nvulnpilot update-feeds\n```\n\nThe GitHub repository also runs an automated daily feed sync via GitHub Actions.\n\n---\n\n## Supported scanners\n\n| Scanner | Status |\n|---|---|\n| Nessus (.csv export) | ✅ Supported |\n| Qualys | Planned |\n| Rapid7 | Planned |\n| OpenVAS | Planned |\n| Microsoft Defender | Planned |\n| AWS Inspector | Planned |\n\n---\n\n## Roadmap\n\n**v0.1.0 — Community Preview ✅**\n- [x] Nessus CSV parser\n- [x] CISA KEV enrichment\n- [x] FIRST EPSS enrichment\n- [x] Composite risk scoring\n- [x] Prioritized terminal output\n- [x] GitHub Actions daily feed automation\n\n**v0.2.0 — Released ✅**\n- [x] HTML report export\n\n**v0.3.0 — Released ✅**\n- [x] SOC 2 audit evidence pack — `--evidence soc2`\n- [x] Local scan history (foundation for verification and trends)\n\n**v0.4.0 — Released ✅**\n- [x] Remediation verification — `vulnpilot verify` (✓ Verified Fixed / ● Still Open / + New)\n- [x] Scan-scope guard — hosts missing from a new scan are never counted as fixed\n- [x] Posture trend — `vulnpilot trend`\n\n**v0.5.0 — Next**\n- [ ] ISO 27001 evidence pack\n- [ ] Verification section inside evidence packs\n- [ ] Plain-English remediation guidance\n\n**Later**\n- [ ] DPDP and HIPAA evidence packs\n- [ ] Plain-English remediation guidance\n- [ ] Weekly digest\n- [ ] Qualys CSV support\n- [ ] Jira / Slack integration\n\nFuture development priorities are driven by community feedback and real-world usage.\n\n---\n\n## Requirements\n\n- Python 3.10, 3.11, or 3.12\n- pip\n- Internet connection for feed updates (air-gapped use supported after initial download)\n- Nessus .csv export file\n\n---\n\n## Contributing\n\nIssues, bug reports, and pull requests are welcome.\n\n- **Bug reports and feature requests:** [github.com/PatchVex/vulnpilot/issues](https://github.com/PatchVex/vulnpilot/issues)\n- **Security disclosures:** security@patchvex.com\n\nGood first issues are labelled `good first issue` in the issue tracker. Please search existing issues before opening a new one.\n\n---\n\n## Acknowledgements\n\nVulnPilot uses publicly available threat intelligence published by:\n\n- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n- [FIRST Exploit Prediction Scoring System (EPSS)](https://www.first.org/epss/)\n\nThank you to both organizations for maintaining these community resources.\n\n---\n\n## License\n\nMIT License — see [LICENSE](https://github.com/PatchVex/vulnpilot/blob/main/LICENSE) for details.\n\nFree to use, modify, and distribute. Commercial use permitted.\n\n---\n\n## About PatchVex\n\nVulnPilot is built and maintained by [PatchVex](https://patchvex.com).\n\nPatchVex builds privacy-first workflow tools for security and DevSecOps teams. Our products help engineers spend less time managing vulnerability data and more time fixing the issues that matter.\n\n- Website: [patchvex.com](https://patchvex.com)\n- Email: hello@patchvex.com\n- GitHub: [github.com/PatchVex](https://github.com/PatchVex)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatchvex%2Fvulnpilot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpatchvex%2Fvulnpilot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatchvex%2Fvulnpilot/lists"}