Takes a device's CPE (a standardized product name like cpe:2.3:o:siemens:simatic_s7-300) and asks the NVD database which known CVEs affect it — passively, with Redis caching and rate-limit backoff so you never hammer the API.

Decodes a CVSS vector string into plain metrics — how it's attacked (AV), how hard (AC), what access it needs (PR/UI), and what it breaks (C/I/A) — then computes the 0–10 severity score and band. Edit the vector and watch the score recalculate live.

Drives authorized active scanners. OpenVAS/Greenbone runs its full GMP lifecycle — feed check → create target → launch task → poll → fetch report → clean up — and Nuclei runs safe-only templates, parsing JSONL results and tolerating timeouts with partial output.

Shows the logic for checking devices against known default credentials across HTTP, SSH, Telnet, RTSP and ONVIF — trying vendor-specific defaults first, then a generic list, and stopping on the first success.

Combines six signals — CVSS severity, exploit probability (EPSS), known-exploited status (CISA KEV), evidence strength, network exposure, and device role — into one ranked risk score. Click any row to see the breakdown.

Separates candidate findings (unconfirmed) from confirmed weaknesses, shows which detection methods agree (convergence), and records each validation decision — confirm, false-positive, or risk-accept — with owner, reason and expiry.

Shows, for every discovery method, whether it completed, was disabled, unavailable, or failed — plus its confidence and safety posture — and streams live progress events as a scan runs.

A natural-language guide over your scan results. Ask which devices need attention, what a CVE means in plain English, which findings are KEV, or for a summary — and get an answer grounded in this session's data.

The Rules-of-Engagement and RBAC gate. It shows exactly which actions are permitted in each phase and refuses active scanning or credential checks until the run is explicitly authorized.

A roll-up of the latest run — assets discovered, evidence collected, and your top risks at a glance.

Groups every discovered asset into a category topology — a hub-and-spoke map where the Core links out to each device class, vendor, zone or risk tier. Click a group to focus it; re-group from the selector.

Every discovered asset with its identity, role, and product fingerprint (CPE).

Maps every finding to the controls that recognized frameworks require — turning a CVE into an auditable compliance gap expressed in NIST CSF 2.0, NIST SP 800-53, IEC 62443 and MITRE ATT&CK for ICS language.

Controls where the lab gets its threat data (inbound feeds) and where it sends findings (outbound forwarders). Today it's simulator-backed; flip a source to Live to pull from the real NVD / CISA KEV / EPSS APIs with Redis caching + rate-limit backoff, or enable a forwarder to push findings to your SIEM.

Turns confirmed findings into tracked remediation tasks on a board — To do → In progress → Done — each with a priority, owner, due date, and links back to the asset and CVE that justify it.

Manages the local collector that runs inside the network and uploads evidence — its enrollment, run authorization, health, and exactly what each run observed, method by method.

Generates customer-grade discovery reports locally — executive summary, operator review, and a technical evidence appendix — each a deterministic export with source provenance, ready as HTML, PDF, JSON or CSV.

Local, discovery-only controls — appearance, default scan profile, retention, report defaults, collection mode, and secret redaction. Saved on this device; nothing here triggers a later-phase action.