Company

Methodology

EVULNABLE uses documented, evidence-driven methodologies across its risk-intelligence products. Read how we score CVEs or how we research companies.

Product area

Vulnerability Management

Findings from different scanners and advisories are normalized onto one shape, then enriched so that severity is not the only input to urgency.

Normalization — scanner exports and vendor advisories reduced to one comparable finding shape.
CVSS — the published severity, used as one signal rather than as the answer.
CISA KEV — whether the vulnerability is known to be exploited, and any remediation deadline attached to it.
EPSS — the published probability that a vulnerability will be exploited.
Exploitation evidence — ransomware association and other real-world signals.
EVRS — the combined score those inputs produce, and the prioritization built on it.

How we score CVEs →

Product area

Due Diligence

Research is assembled from public and authoritative sources, and every statement carries where it came from and how much weight it should be given.

Entity resolution — establishing which company is actually being asked about before anything is screened.
Source collection — registries, sanctions and watchlists, litigation and public records, media.
Evidence grading — how directly a source supports the statement it is attached to.
Confidence assessment — how much the finding as a whole can carry.
Source attribution and retrieval dates — what was read, and when it was read.
Gap register — what could not be established, recorded rather than omitted.
AI-assisted research with verification — machine assistance in collecting and organizing material, checked against the underlying evidence.

How we research companies →

What both methodologies have in common

Neither product treats silence as a clean result. If a source was unreachable, a register returned nothing, or a check could not be completed, that is reported as a gap rather than as an absence of risk. It is the single rule both product areas are built around, and it is why both publish their sources and retrieval dates rather than only their conclusions.