signalfort · from outside
CVE and FSTEC BDU: match the stack without NVD
International IDs and FSTEC BDU in one feed. What matters is time to “affects us / doesn’t”, not database size.
- ✓CVE + FSTEC BDU in one contour
- ✓Priority from KEV and EPSS, not CVSS alone
- ✓Matched to your perimeter
- ✓Feeds refresh every hour
signalfort in numbers
Nothing to install. Enter a domain — and the check starts.
Why one database fails
An NVD-centric view misses mid-market reality: FSTEC BDU, OSV/GHSA, and KEV flaws with known attacks online.
- —CVSS 9.8 without an exposed service
- —BDU and CVE in different spreadsheets
- —No “does this hit our nginx” answer
- —World CVE digest instead of perimeter
One data contour
Matching uses what is visible on your hosts.
CVE + BDU
International IDs and FSTEC BDU in one org feed.
KEV and EPSS
First: flaws with known attacks online or high exploitation probability.
OSV / GHSA / EUVD / CIRCL
Package and adjacent feeds without manual merges.
Public exploit
Soft signal (e.g. Metasploit) — not a KEV replacement, keeps risk from sinking.
How to get the feed
Built for your perimeter — not a firehose of every CVE.
- 01
Verify the domain
Without verification you stay in passive product bounds.
- 02
Wait for matching
Your hosts’ stack is compared to feeds.
- 03
Triage from the top
KEV and confirmed risk before “just high” scores.
Orchestrator feeds refresh hourly
CVE table vs perimeter feed
Database size is not decision speed.
- Every CVE in a row
- CVSS only
- BDU separate
- No host binding
- 1.Your stack onlyfrom outside
- 2.KEV + EPSSpriority
- 3.BDU in the same UIone contour
- 4.Affects us / doesn’tproduct goal
From publish to a decision
North-star metric: time to “affects us / doesn’t”, not row count.
Version matched a feed record
Risk triaged: patch / not our context
- ·identifier
- ·host
- ·why prioritized
Who needs matching
Teams tired of merging NVD, BDU and vendor mail in Excel.
Security / compliance
BDU and international IDs without two product contours.
IT lead
Priority by real threat, not pretty CVSS.
Managed service
Client perimeter feed in one dashboard.
Plans for the job
Perimeter hygiene is in every plan; frequency and depth differ.
Radar
Free
Passive analysis and weekly hygiene. One domain.
Contour
from ₽1,490/mo
Daily checks, confirmation, fix deadlines and re-check.
Business
from ₽4,490/mo
5 domains, fix deadlines, webhooks and MCP for AI assistants, FSTEC/CRA reports, deep analysis with consent.
Why not CVSS alone
A critical score without KEV, EPSS and an exposed service can often wait. Already exploited or internet-facing — cannot.
Guides: KEV and EPSS, does a CVE affect you.
Sources in one feed
CVE 5.x, FSTEC BDU, GHSA/OSV, EUVD, CIRCL, and a soft public_exploit signal from public Metasploit metadata.
Feeds update on the orchestrator (not the scanner): enriching the database, not hitting your hosts.
How stack matching works
Versions and signatures from the perimeter produce matches. A match is probable; confirmed only after a safe check on a paid plan.
Start with check a site from outside. For Bitrix/1C see the vertical landing.
FSTEC / CRA reports
BDU matching is in the shared contour. Regulatory exports are on Contour Business at export time — no permanent “RU mode” on the org.
You pick the format when exporting.
FAQ
Do you replace NVD?
We do not rely on NVD alone. We use CVE 5.x and other open feeds plus FSTEC BDU.
Will there be an FSTEC-style report?
Regulatory exports are on Contour Business. BDU matching is in the shared contour.
How often do feeds update?
Hourly on the orchestrator. Stack rematch follows the plan schedule.
Is this a standalone CVE database product?
The feed is built for your hosts. A public encyclopedia of every CVE is S6 — not these landings.
Check my site for free
One feed for your hosts — not an internet digest