PAIN & Remediation Playground

Start with the flaw

Look up a CVE to import its impact and exploit facts. You can review or correct the source data if needed.

CVE ID

Edit imported CVSS details Impact, exploit preconditions, weakness type, and raw vector

Impact — what can it break? ?

Confidentiality C

Integrity I

Availability A

Exploit preconditions ?

Attack Vector AV

Attack Complexity AC

Privileges Required PR

User Interaction UI

Weakness type (CWE)

Where does it live?

Resolve the affected asset’s security-impact profile. This demo uses an illustrative role catalog; CSPs may instead assign CR/IR/AR directly or use another governed mapping. The reusable profile is capped by the System Context ceiling.

Example role or custom profile ?

Holds more than one agency's data Widens the blast radius one level only for Disruptive or Debilitating findings.

Provider Certification Class ?

How likely is exploitation?

Use the imported EPSS and KEV facts, or adjust them to explore how likelihood changes the clock.

Predicted chance of exploitation (EPSS)

0.30

CISA has seen it exploited in the wild (KEV catalog) Starts CISA’s published due-date clock in parallel.

Can a payload reach it?

Check both delivery paths: directly from the internet, or second-hand through another system.

Direct internet path Directly exposedThe internet can reach the vulnerable service itself. Only through a VPN or identity-aware proxyAuthorization happens before traffic reaches the service. Not directly exposedThere is no direct internet path to the vulnerable service.

Second-hand delivery

There is no usable direct path, so check whether a payload can ride in through another system.

Can this CVE trigger from relayed content? ?

This system processes internet-derived content Files, messages, records, or logs that originated outside. Tested defenses block this payload Requires current assessment and monitoring evidence.

Explore what would change it

Apply evidence-backed mitigations to see whether the finding moves to a lower-impact or slower clock.

Mitigations already deployed ? Limits what can leak For example: egress deny or scoped credentials. Limits what can be tampered with For example: non-root or a read-only filesystem. Limits the outage For example: verified redundancy or rate limits. Reduces the odds of exploitation Moves the urgency column; it cannot erase KEV or direct-automation facts.

Method settings Governed thresholds for administrators and model exploration

Severity thresholds ?

Minimal→Narrow0.281152

Narrow→Disruptive0.562303

Disruptive→Debilitating0.933000

Defaults follow the High-centered PAIN calibration; sliders are for governed model exploration.

EPSS trigger point0.50