Free tool
Vulnerability Focus
Your scanner reports thousands of findings, but attackers use only a small share of them. Drop in a Tenable, Rapid7, or Qualys export to see which findings are actually exploited, which have exploits ready to use, and how long each one has been open.
🔒 Your scan data never leaves this browser. Files are read on your computer and aren't uploaded anywhere. The tool downloads only the public CISA KEV and EPSS lists.
Accepted-risk exceptions are saved only in this browser.
Loading CISA KEV and EPSS…
No scans loaded yet. Load an export above, or click Try with sample data to see how it works.
How long findings have been open
Fix first
| # | Priority | Vulnerability | CVE | Severity | EPSS | Assets | Oldest |
|---|
Assets by exposure
| Asset | OS | ● In the wild | ▲ Exploit available | ○ No known exploit | Oldest exploitable | Top issue |
|---|
| Priority | Asset | Vulnerability | CVE | Severity | EPSS | Age | First seen | Scanner |
|---|
Accepted risk
Findings you can't fix yet, such as legacy systems or vendor-managed appliances, with a reason, an owner, and a review date. When the review date passes, the finding counts again.
| Vulnerability | Scope | Reason | Owner | Review by | Open findings covered |
|---|
How priorities work
- ● Exploited in the wild: the CVE is in CISA's Known Exploited Vulnerabilities catalog, or your scanner reports it's used by malware or ransomware. Fix these first.
- ▲ Exploit available: your scanner reports a public exploit (for example Metasploit, Exploit-DB, or an exploit kit), or the EPSS score says there's at least a 10% chance it's exploited in the next 30 days. You can change that threshold.
- ○ No known exploit: everything else. It still needs patching, but it can follow your normal cycle. Informational findings are left out.
- Age comes from the scanner's first-seen date (Tenable “First Discovered / First Seen”, Rapid7 “Vulnerable Since”, Qualys “First Detected”). If an export doesn't include one, age is counted from the earliest scan you loaded.
- Fixed means the scanner marked it fixed, or a later scan of the same asset from the same scanner no longer reports it.
What exports work
- Tenable: Nessus
.nessusfile or CSV; Tenable Security Center vulnerability detail CSV; Tenable Vulnerability Management vulnerability export CSV. - Rapid7 InsightVM / Nexpose: a CSV report with asset IP, vulnerability ID or title, severity, and CVE columns (add “Vulnerable Since”, “Exploit Count”, and “Malware Kit Count” for best results), or an XML Export 2.0.
- Qualys VM: a scan or scorecard report exported as CSV (the header rows Qualys adds at the top are handled automatically), or a scan / asset data report as XML.
Up to 1,000 assets per analysis (larger files are split into batches by IP address that you can switch between), 150 MB per file. This tool helps you decide what to fix first. It isn't a substitute for your scanner or your own judgment.