Cap 1
Exploitability score
One score per finding built from runtime presence, reachability, threat intelligence, asset criticality and control coverage.
UI · exploitability score
CTEM Lifecycle · 02
Assess & Validate
Zafran scores every finding on exploitability rather than CVSS alone: runtime presence, internet reachability, exploitation in the wild, asset criticality and the mitigating controls already in place. Validation proves which exposures an attacker could actually use, so the 99% of criticals that are not exploitable stop competing for attention.
Capabilities
How Zafran Enables Assess & Validate
Prove what is actually exploitable using runtime presence, reachability, threat intel and control coverage.
Cap 2
From criticals to exploitable
Thousands of CVSS criticals narrow to the handful that are truly exploitable in your environment.
UI · validation funnel
Cap 3
Evidence behind every verdict
Each verdict shows why: loaded in memory, reachable from the internet, weaponized, not covered by a control.
UI · evidence breakdown
Cap 4
Validated exposure queue
A ranked list of validated exposures with the controls that already cover them and the ones that do not.
UI · validated queue
Workflow
How it works
- 01
Enrich with runtime and reachability
Zafran checks whether the vulnerable component is actually loaded and whether the asset is reachable from the internet.
- 02
Correlate threat intelligence
Exploitation in the wild, weaponization and active campaigns are matched to each finding as they emerge.
- 03
Validate against your defenses
Existing EDR, firewall, WAF and identity controls are mapped to each exposure to prove what is still open.
Compare
Zafran vs. the alternatives
Zafran runs the whole lifecycle on one Exposure Graph; alternatives cover a slice of it.
| Capability | Zafran | CVSS-only prioritization | Breach & attack simulation |
|---|---|---|---|
| Runtime presence (loaded vs. installed) | |||
| Internet reachability analysis | |||
| Exploitation-in-the-wild intelligence | |||
| Mitigating-control coverage per finding | |||
| Continuous validation without agents or attack traffic | |||
| Validated output flows into mitigation and remediation |
Yes Partial NoIllustrative; final rows per stage TBD with PMM
Proof
What customers see
99%
of critical vulnerabilities are not exploitable
1 in 3
CVEs weaponized on the day of disclosure
5
exploitability signals evaluated per finding
“Zafran lets us evaluate the effectiveness and ROI of our security stack against what is actually exploitable.”
Dave Estlick
CISO, Chipotle
Case study · Financial Services
Fortune 500 Financial Institution stopped panic patching
Read how the team ran this stage of the lifecycle with Zafran.
FAQ
Assess & Validate: questions buyers ask
What does "assess and validate" mean in the CTEM lifecycle?
Assessment scores each exposure on real-world exploitability; validation proves whether it can actually be exploited in your environment. Zafran does both continuously, using runtime presence, internet reachability, exploitation intelligence, asset criticality and existing control coverage.
How does Zafran calculate exploitability?
Each finding is evaluated on five signals: is the vulnerable component loaded at runtime, is the asset reachable from the internet, is the vulnerability being exploited in the wild, how critical is the asset, and is a compensating control already blocking the attack path. The result is a single exploitability score with its evidence.
Why are 99% of critical vulnerabilities not exploitable?
Most CVSS "critical" findings sit on components that are never loaded, on assets that are not reachable, or behind controls that already block the attack path. CVSS measures theoretical severity, not whether an attacker can use the flaw against you.
Is Zafran validation the same as breach and attack simulation or penetration testing?
No. BAS and pen tests generate attack traffic on a schedule against a sample of systems. Zafran validates continuously across the whole estate by analyzing runtime state, exposure and control coverage, without injecting attacks.
How does Zafran use CVSS, EPSS and CISA KEV?
They are inputs, not the answer. CVSS, EPSS and KEV data are combined with your own runtime, reachability and control context so that a KEV-listed CVE on an unreachable, mitigated asset ranks below a lesser-known one that is open and loaded.
Does assessment require deploying agents?
No. Assessment runs on the agentless data collected in the discovery stage plus API integrations with your security stack.
See Zafran in Action
Prioritize and fix what is truly exploitable using risk context from your existing security tools.