Zafran's Exposure Graph weighs what's running and reachable, exploited in the wild, unprotected by your controls, and critical to the business, leaving your team with a defensible short list to fix.
12,840 findings. Zafran weighs runtime (5,264 running), reachability (1,930 reachable), active exploitation (514 exploited), business criticality (212 on critical assets) and compensating controls (128 with no control in place): the top 1% that is exploitable. Fix these first: CVE-2021-44228 (CVSS 10.0) and CVE-2024-6387 (CVSS 8.1).
Confirm whether vulnerable code is actually loaded to memory, across every asset in your hybrid stack.
Zafran's risk rings for CVE-2021-41773, with the runtime ring in focus: runtime adds +1.0 to the base risk because the vulnerable code is loaded in memory. The CrowdStrike Falcon sensor shows httpd 2.4.49 (pid 812) and mod_cgi loaded; apr-util is installed but has not run in 90 days. Base risk +9.2, controls -3.3, applicable risk 5.9, Medium.
Model the real path to each asset, outside-in and inside-out, through NAT, load balancers, WAFs, and firewalls.
Zafran's risk rings for CVE-2021-41773, with the network reachability ring in focus: reachable from the internet, it adds +2.0 to the base risk. The path runs from the internet through a network ACL open on ports 1 to 65535 and a security group open on 443 to the instance. Base risk +9.2, controls -3.3, applicable risk 5.9, Medium.
Flag what attackers are exploiting in the wild, with threat intelligence from multiple sources.
Zafran's risk rings for CVE-2021-41773, with the threat ring in focus: the vulnerability is actively exploited, adding +0.5 to the base risk. Its signals: on the CISA KEV list (known exploited), exploited in the wild (active), an EPSS probability of 97.4%, and a public exploit available. Base risk +9.2, controls -3.3, applicable risk 5.9, Medium.
Set business criticality with your own rules and let an AI agent suggest levels for any assets you haven’t classified.
Zafran's risk rings for CVE-2021-41773, with the business criticality ring in focus: the asset's criticality is High, scored automatically from your own rules, a production tag, the PCI cardholder segment and the payments subnet. Base risk +9.2. Controls -3.3, applicable risk 5.9, Medium.
Identify which existing firewall, WAF, cloud security group, and EDR configurations already block a finding.
Zafran's risk rings for CVE-2021-41773, with the controls in focus: the live configuration of three controls takes -3.3 off the base risk of +9.2. CrowdStrike Falcon's prevention policy blocks the exploit (-1.0), the Palo Alto NGFW has threat ID 91648 in block mode (-1.5), and the Akamai WAF path-traversal rule is active (-0.8). Applicable risk 5.9, Medium.
Combine every signal into one score, with each weight configurable by your team.
Zafran's applicable risk score for CVE-2021-41773: every signal adds up to one score of 5.9, Medium. Vulnerability +2.2, runtime +1.0, network reachability +2.0, threat intelligence +0.5 and business criticality +3.5 build the base risk of +9.2; compensating controls take off 3.3. Each weight is configurable by your team.
90% of CVSS criticals down to medium or low
Fortune 500 Commercial Insurer
A Fortune 500 commercial insurer used runtime, reachability, and control context to bring 90% of its CVSS criticals down to medium or low.
Top 5 U.S. Health Insurer
“Without Zafran, it would have taken me 10 plus people just to do the analysis.”
VP, Enterprise Information Security
Prioritize and fix what is truly exploitable using risk context from your existing security tools.
