Every vulnerability, ranked by what it can actually do to you.
Your scanners find hundreds of CVEs. Frontier Audit scores each one against live threat intelligence and your own asset inventory, then hands you a ranked remediation plan with the reason for every call.
Scanner severity says how bad a flaw could be in general. It does not know that the server is internet-facing, holds regulated data and has no patch window - or that the "critical" finding sits on a dev box nobody can reach.
Frontier Audit joins the two halves: what attackers are doing right now, and what each of your assets is worth. The result is a short list of what to fix first, and a written reason for everything else.
About iKavach
iKavach: the engine behind Frontier Audit.
Kavach is the Sanskrit word for armour. iKavach is the vulnerability-prioritisation engine that does the scoring in every Frontier Audit.
It reads your asset inventory and scanner findings, enriches every CVE with live threat intelligence, and scores it with fixed rules - so the same inputs always produce the same plan, and every verdict can be traced back to its reasons.
Inputs
Asset inventory + scanner findings (CSV)
Threat feeds
CISA KEV · FIRST EPSS · NVD · MITRE ATT&CK
Method
Risk = Threat × Impact, deterministic
Output
Ranked plan in 5 buckets, with reasons + CSV
Live threat intelligence
Known exploitation (KEV), exploit probability (EPSS), CVE detail (NVD) and confirmed attack techniques (ATT&CK), checked for every finding.
Asset-aware scoring
The same CVE scores differently on a production domain controller and a dev workstation - role, environment, data and exposure all count.
No model in the loop
Fixed weights and thresholds, no AI guessing. Re-run it next month on the same files and you get the same ranking.
Every verdict explained
Each finding carries plain-language reasons: which signals raised it, which controls lowered it, and why it landed in its bucket.
Reproducible runs
The threat data used is saved with each run, so a plan can be re-checked later exactly as it was scored.
Strict input checks
Unknown assets, invalid CVE ids and conflicting rows are all reported at once, before anything is scored.
iKavach’s scoring method is derived from RhinoSecure, a Carnegie Mellon Agentic AI capstone project by Andrew Kopshin.
What goes in
Two files you already have.
01
Asset inventory
One row per system: role, criticality (1-5), environment, data sensitivity, internet exposure, patch window, compensating controls and owner.
02
Scanner findings
One row per finding from any scanner that exports CSV: the CVE, the affected asset, scanner severity, and product, version, port and evidence where you have them.
We check both files before scoring and send back every problem at once - unknown assets, invalid CVE ids, conflicting rows - so they are fixed in one pass.
How a finding is scored
Risk = Threat × Impact.
Threat - is anyone exploiting this?
CISA KEV - confirmed exploitation in the wild sets a floor on the score.
FIRST EPSS - the probability the flaw is exploited in the next 30 days.
NVD - the published severity and details of the CVE.
MITRE ATT&CK - whether the technique is confirmed in real attack procedures.
Impact - what would it cost you?
Criticality of the asset to the business.
Environment - production weighs more than staging or dev.
Data sensitivity - regulated, confidential, internal or none.
Role - a domain controller's blast radius is not a printer's.
Exposure and controls - internet-facing raises the score; each compensating control lowers it.
What comes out
Every finding lands in one of five buckets.
Patch now
High risk on an asset that matters. Act before the next window.
Next window
Real, but a patch window is already declared for the asset.
Mitigate & monitor
A compensating control is in place. Watch it, patch when you can.
Accept
Below the action threshold. Recorded, with the reason, and left alone.
Contested
Known exploited, no control, no window. Flagged for a human decision - never forced.
How it works
From scanner export to a plan your team can act on.
Share two filesUpload your asset inventory and scanner findings to your secure client portal.
We score every findingAgainst the four threat feeds, using a saved snapshot of the data so the run can be repeated exactly.
An auditor reviews itContested findings get a human decision, and the plan is checked before it reaches you.
You get the ranked planHighest risk first, each with its reasons, plus a CSV your team can load straight into its tracker.
Why it holds up
Deterministic, so it can be defended.
No AI in the score. The same files and the same threat data always give the same ranking.
Every verdict is explained. Each finding carries the plain-language reasons behind its score and bucket.
Repeatable. The threat data used is saved with the run, so the plan can be re-checked later.
On the record. Each plan is logged to your audit's tamper-evident trail.
Questions
Before you request one.
Which scanners does it work with?
Any scanner that can export findings with CVE ids to CSV. We map the columns to the two files during scoping.
Do you need access to our network?
No. Frontier Audit works from the two files you upload to your client portal. Nothing is scanned or connected to.
Is this a penetration test?
No. It prioritises the findings you already have. If you need new findings, we can scope that separately.
What does it cost, and how long does it take?
Both depend on the number of assets and findings, and are agreed at scoping. Nothing is charged until you approve the scope.
Turn a scanner export into a plan your team can act on.
We reply within one business day. Nothing is charged until you approve the scope.