CASSI ยท Continuous Attack Surface Security Intelligence
AI-powered vulnerability analysis.
Running entirely on your machine.
A private AI vulnerability analyst that understands and prioritizes what your scanner already found.
The threat landscape has changed. Attackers are already using AI to weaponize vulnerabilities and chain lower-severity bugs together faster than human defenders can keep up. CASSI puts that same capability in your hands, with a critical difference: local by default. Nothing leaves your machine unless you connect an external model.
- Local by default
- Works on the scan results you already have
- Full vulnerability database on your machine, refreshed daily
- Intelligence by CVE Security
Coming from CVE Security? Here is how to find out whether a CVE is in your environment.
CASSI matches KEV Watch, KCV and KCV Watch entries against your own scan results, on your machine, and shows which ones your scanner has already found and on which assets.
The new reality
Attackers are using AI. Your defense can use it too.
AI-assisted attack tooling is here. Automated reconnaissance, faster weaponization and intelligent exploit chaining are being used against real infrastructure now, and they turn lower-severity bugs into working intrusions. Patching by severity score misses those chains, and nobody can patch everything.
Defenders need the same kind of tooling. CASSI gives you an AI analyst of your own. It reads your findings in context, ranks them on evidence, and goes back over them every night as the threat changes. Your scan didn't change. The threat did.
Most AI-powered security products require sending your findings and infrastructure details to someone else's cloud. That's an unacceptable trade. CASSI brings the intelligence to your data instead.
CASSI is not a scanner. It does not run scans, test targets or find new vulnerabilities. It works only on the findings you bring, from the scanner you already use.
How it works
Four steps, all on your machine.
-
Import
Load an export from your existing scanner. Nessus files first, alongside generic CSV, with more formats to follow.
-
Enrich
CASSI keeps a full copy of the CVE Security vulnerability database on your machine, refreshed daily, and matches every finding against it. Answers come from that local copy.
-
Ask and assess
A local AI analyst answers plain-language questions about your findings. Each answer links to its evidence.
-
Plan and report
CASSI produces a prioritized remediation plan and an exportable report. The plan can respect constraints such as patch windows or frozen systems.
Privacy
Local by default.
Nothing leaves your machine unless you connect an external model. We never receive your findings. You decide whether any other service does.
- Scan files, asset names, IP addresses and findings stay on your machine.
- CASSI Security never receives your findings, in any mode.
- The intelligence pack, a full vulnerability database, is downloaded to you. Every customer gets the same pack, so the download reveals nothing about your environment.
- The daily sync sends your license key and nothing about your findings. Like any download, it exposes an IP address and a time.
- Your imported data and reports live in a project folder you own.
Because the whole database is on your machine, answers come from the local copy rather than from a remote lookup. The Trust page goes into detail: what stays local, what the sync sends, how external models work, and what happens to your data when a license ends.
Questions CASSI helps answer
The fewest patches that break the most attack paths.
The big question is simple: of everything the scanner found, what matters now? These are the smaller questions CASSI answers to get there.
Which findings are being exploited?
Including ones reported as exploited before they reach the CISA KEV catalog, and exploited findings that are still unpatched with no detection rule available.
Evidence Powered by KEV Watch
Which minor findings form a documented exploit chain?
Findings on the same asset that a cited source reports were used together, even when each looks minor on its own.
Documented Powered by KCV
Which findings could chain?
Findings on the same asset where one gives an attacker what the next requires. Shown separately from documented chains, and always labeled as inferred.
Inferred Powered by KCV Watch
Which findings have ready-made tooling?
Public exploit code or attack tooling exists for them, so automated and AI-assisted attackers reach these first.
Which single update closes the most?
Findings grouped by the update that fixes them, so one upgrade can close many findings and break the links in a chain.
What changed overnight?
What became more dangerous since the last intelligence update, with no rescan needed.
Then CASSI turns the answers into a remediation plan that fits the limits you state, such as ten hosts this week, and an editable report you can brand and hand to a client or manager, with data sources credited.
Intelligence by CVE Security
The datasets behind the answers.
Every day CASSI downloads a full copy of the CVE Security vulnerability database to your machine. Three named datasets inside it matter most for prioritizing. On the CVE Security site they describe vulnerabilities in general. In CASSI they answer a narrower question: which of these are in my environment?
KEV Watch
A nightly list of vulnerabilities with credible exploitation reports that are not yet in the CISA KEV catalog. KEV Watch reports exploitation evidence. It does not predict what CISA will list, and it is not affiliated with or endorsed by CISA.
KCV Known Chained Vulnerabilities
A catalog of vulnerabilities documented as working together in an attack path, with the source cited for each chain.
KCV Watch
Analysis that flags vulnerabilities likely to chain, by comparing what one gives an attacker with what another requires. Every KCV Watch result is a candidate to research, never a known attack, and CASSI keeps it visibly separate from documented chains.
The KEV Watch record, as of
Hit rates vary widely by type of evidence: by evidence pattern, between 1.3% and 68.9% of KEV Watch entries reached the CISA catalog within 90 days. These are measurements of past listings, not a forecast. KEV Watch reports exploitation evidence and does not predict what CISA will add. Figures from kev.watch.
Exploitation reports in KEV Watch include VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV). See all data sources and credits.
Who it's for
Built for people who can't send findings to a cloud.
Security service providers
Pentesters, consultants and MSSPs
The problem
Client data is under NDA and cannot go to a cloud AI. And every report looks like everyone else's.
What CASSI gives you
Confidential analysis on your own machine, and a differentiated, evidence-backed report for the client.
In-house IT and security teams
Infrastructure, operations and security staff
The problem
Thousands of findings, limited patch windows, and no clear order of work.
What CASSI gives you
A short, defensible list of what to patch first, and a plan that fits your constraints.
AI models
A local model, on your hardware.
CASSI ships with IBM Granite, an openly licensed model, packaged with the product and running on your own hardware. That is the product, and it is what we recommend.
If you accept the trade-off, you can connect a different model instead: OpenAI, Anthropic, another provider, or your own internal inference server. External models are off by default. You turn them on deliberately, with your own API key, and requests go straight to the provider. Nothing passes through CASSI Security or InfoBakery servers. Data sent to a model you configure is your responsibility. How external models work.
Editions and pricing
Try the full product free for 30 days.
CASSI is a per-seat subscription. The trial is the full product, not a cut-down edition, and there is no free tier after it. When a trial or subscription ends, analysis stops and your imported findings and past reports stay in your own project folder.
CASSI Desktop
Runs on one analyst's machine. Ships first.
CASSI Server
A self-hosted edition for teams, inside your perimeter, with the same local-by-default design. Availability to be announced.
Seat pricing will be announced at launch. Join the list and we will send it to you. The CVE Security website stays free. Pricing and trial details.
FAQ
Questions security buyers ask first.
Does CASSI run scans?
No. CASSI does not run scans, test targets or find new vulnerabilities. It analyzes the findings you import from the scanner you already use.
Where does the intelligence come from?
CASSI downloads a full copy of the CVE Security vulnerability database to your machine every day and matches your findings against it locally. Answers come from that local copy. Three named datasets inside it, KEV Watch, KCV and KCV Watch, drive the exploitation and chain answers.
What leaves my machine?
By default, your scan files, asset names, IP addresses and findings stay on your machine, and CASSI Security never receives them in any mode. The daily database download sends your license key and nothing about your findings. If you choose to connect an external model, whatever you send to that provider goes directly to them, under their terms.
Which scanners are supported?
CASSI imports scanner exports rather than running scans. Nessus files come first, alongside generic CSV, and more formats follow. The launch list will be published before release.
What happens when my trial or subscription ends?
CASSI shows a license-expired message and analysis stops. Your imported findings and past reports remain in your own project folder.
What hardware does the local model need?
CASSI runs IBM Granite on your own hardware. Minimum and recommended specifications will be published before launch.
How is KCV different from KCV Watch?
KCV is documented: each chain has a cited source reporting that the vulnerabilities were used together. KCV Watch is inferred: it flags pairs that could chain because what one gives an attacker matches what the other requires. CASSI labels the two differently and never presents a KCV Watch result as a known attack.
Why this matters now
Get the launch email.
The organizations that adopt local AI-powered defense keep their vulnerability data private. The ones that adopt cloud AI-powered defense hand their attack surface to whoever they trust with that data. CASSI is built for people who understand which side of that line they need to be on.
One email at launch, with trial details. No spam.