- Asset
- build-01
- CVSS
- 10.0
- EPSS
- 94%
- SSVC
- Act
- First seen
- 29 Mar (199d)
ImpactRemote code execution on an internet-facing build host.
RemediationPatch to xz 5.6.2+ or rebuild from a clean toolchain.
CVE-2024-3094 · CWE-506 · CIR Annex §6.10 · scan #8f2a
Which vulnerabilities are actually yours?
Bring your software, devices, and the OT you cannot safely scan. We surface the vulnerabilities that are real, exploitable, and yours.
Free for your first assets. No agent, nothing to install, EU-hosted.
relevance, not noise
Most of the firehose is not yours. We find the part that is.
A raw feed dumps every advisory ever published on you. We keep only the ones running on your own kit, being exploited right now, and backed by a source, so your team fixes what matters first.
512advisories in the raw feed
Everything a plain feed would hand you.
3are yours, and exploitable
IP camera, outdated firmwareexploited now
PLC exposed to the internetknown exploit
Operator HMI, no authenticationhigh risk
Matched to your assets · down to model and firmwareExploitability-ranked, not CVSS aloneProvenance on every finding you can hand to an auditor
how it works
Inventory in. Your real vulnerabilities out. Continuously.
Bring01
Your inventory
Send an SBOM, a CMDB export, an OT discovery feed, a device list or an API call. Software, hardware, firmware.
Match02
Against the graph
We resolve each asset and device to the vulnerabilities that affect it, across the whole source graph, down to model and firmware.
Prioritise03
What is actually exploitable
We rank by real-world exploitation (KEV, EPSS, exploit intel), not CVSS alone, and link every finding to its source.
Watch04
Continuously
Every new advisory re-matches against your inventory. When something you own becomes exploitable, you hear about it.
what you get
The report your auditor accepts.
Every match turns into dated evidence: your real findings, ranked, each traceable to where it came from, exportable as the proof a NIS2 or CRA audit asks for.
NIS2 posture report
Acme NIS2 s.r.o. · Bratislava, SK
D50/100
Material gaps. Two internet-facing assets are exploitable today.
- 312 open
- 1 in KEV
- 2 high
- 1 medium
- 1,284 assets
Findings
- Asset
- plc-floor2 · OT
- CVSS
- 7.5
- EPSS
- n/a
- SSVC
- Attend
- First seen
- 02 Oct (12d)
ImpactOT controller reachable from the IT VLAN.
RemediationSegment the OT network and apply Siemens SSA-818183.
SSA-818183 · CWE-306 · BDU
Prioritised remediation
| Priority | Target | Finding | Action |
|---|---|---|---|
| P1 | overdue 6d | F-01 | Patch xz on build-01 |
| P2 | due in 9d | F-02 | Segment OT, apply firmware |
integrity 8f2a9c…e041Export · NIS2 · CRA · CSV · PDF
who it is for
One graph, four ways in.
Everyone matches against the same graph. What changes is the way in.
Security teams
See which exposures are actually exploitable before you spend a sprint on them.
MSSPs
Run every client against the same graph, white-labelled, with provenance you can hand to their auditor.
OT and IoT owners
Assess the devices you must not actively scan, by model and firmware, without sending a packet.
Builders
Pull matches and provenance into your own tools over our API.
who we protect
Built for the systems attackers target.
The systems that keep a country running are hard to see and dangerous to scan. We reach them anyway, by vendor, model and firmware, without sending a packet.
why grimoire
The knowledge other tools do not have.
Most tools hand you a raw feed of alerts to wade through. We do the opposite: we collect what the whole world knows about security weaknesses, link it into one map, match it to your own systems, and show the source behind every fact. That map is grimoire, and it holds knowledge most tools simply do not have.
- grimoire/ɡrɪmˈwɑːr/
- Once, a book of arcane knowledge. Ours is the book of everything known about security weaknesses: who they affect, how attackers abuse them, and where each fact came from. Free to browse, and the source behind every report.
More sources, even the ones others skip
We gather from vulnerability sources all over the world, including the national government ones that most tools quietly leave out.
Device-level OT and IoT matching
Match by vendor, model and firmware, so you can assess devices a scanner would crash.
A graph, not a list
Everything is linked together, so each weakness arrives with the full story around it, not just one line in a list.
Traceable, kept in the EU
Every claim links back to its source. Nothing leaves the EU.
plc-floor2
Siemens SIMATIC S7-1500 · fw 2.9
You can't safely scan a PLC. We match it by vendor, model and firmware, no probe, no risk to the line.
- SSA-818183Auth bypass (web server)BDU · Siemens
- CVE-2023-28832DoS via crafted packetNVD
- CVE-2022-38465Private key extractionNVD · ICS-CERT
- Everything public we can find on security weaknesses, from feeds worldwide to the national sources most tools skip*
- What attackers trade on the dark web(coming soon)
official national feeds worldwide, plus the major open-source ecosystems, with more added all the time
20+ sourcesone graph you can trustproof your auditor accepts
Open grimoirefree to start
Browse the graph free. Match your assets free to start.
The graph, free
Browse every vulnerability, source and link. Rate-limited, no account needed.
Match your assets
Match your first assets free. Pay as you scale to continuous monitoring, OT and IoT, API and compliance exports.
questions
Straight answers to common questions.
Do you scan my systems?
No. You send us your inventory, the software, devices and OT/IoT you cannot safely scan, and we match it against the graph. Nothing to install, nothing that touches your network. That is exactly why we can cover OT.
How is this different from a scanner?
A scanner only sees what it can reach from outside your perimeter. We start from a vulnerability graph built from the public and sovereign sources most vendors skip, match it against what you actually run, and surface what is real and exploitable, continuously, not just a high CVSS score.
What sources do you cover?
More than 20 public threat-intelligence sources, including the sovereign feeds most vendors skip. We resolve them into one graph and keep the provenance, so you can trace every finding back to where it came from.
Where does my data go?
Built and hosted in the EU. Our servers are Hetzner (Germany), our content delivery is Bunny.net (Slovenia), and our email is Scaleway (France). All three are EU companies under EU law, so no provider under US jurisdiction processes your data. We name them in our privacy notice.
Can I use it through an API?
Yes. Query the matching and the graph straight from your own tools over our API, with a free monthly quota and MCP support, so you are never stuck reading a dashboard.
Does this help with NIS2 and CRA?
Yes. We turn each match into dated, sourced evidence you can export for a NIS2 or CRA audit, so your report reads from what you actually run.
Find out which vulnerabilities are actually yours.
Match your first assets free. Browse the whole graph free. EU-hosted.
Free for your first assets. No agent, nothing to install, EU-hosted.