What is an early warning system for zero-days and emerging threats?

An early warning system reports newly published vulnerabilities (CVEs) and vendor advisories that affect the technologies you use, before the next regular scan finds them. The decisive part is matching against your own inventory: only then do the thousands of CVEs per month shrink to the few that actually concern you. The blacklens.io Threat Center performs this matching in real time and then checks exploitability automatically.

How quickly will I learn about a new vulnerability?

New CVEs are matched against your technology inventory in real time. EPSS, KEV and exploit signals are refreshed every six hours, and alert delivery runs every five minutes. Between publication of a CVE and your alert there are usually only minutes, depending on when the sources publish the entry.

What does "verified automatically" mean?

A hit in the version match is initially a potential threat. If a matching check template exists, blacklens.io automatically launches a targeted scan against the affected system (state: verifying). If the vulnerability can be demonstrated, the threat changes to confirmed; otherwise to not confirmed. Threats that are no longer relevant expire or are dismissed by your team. With "Verify now" you can trigger verification manually at any time.

How is this different from a CVE newsletter or a CERT feed?

Newsletters and CERT warnings are generic: you have to check yourself whether and where the named product runs in your environment. The Threat Center knows your inventory from external scans, Sentry and cloud connectors, filters by product and version, adds EPSS and CISA KEV and verifies the hit by scan. You get a list of affected hosts instead of a link to read on.

Can I route alerts by team and channel?

Yes. Notification policies filter by severity and alert type and define recipients in the workspace as well as integrations, for example critical threats to Microsoft Sentinel and as push notifications to the SOC, medium ones as a Jira ticket for the platform team. Below the CVSS threshold, 7.0 by default, no alert is created. With EPSS above 0.80 and an available exploit, an alert is escalated automatically, and alerts that are no longer relevant expire after 30 days.

Which sources does blacklens.io use for threat intelligence?

Among others NVD, VulDB, EPSS (FIRST), VulnCheck including CISA KEV, public exploit and PoC sources and DarkFeed. The signals are merged per CVE: EPSS score and percentile, KEV inclusion with due date and ransomware flag, exploit availability, CVSS v3 and v4, CWE and fixed version. New CVEs are matched against your inventory in real time, and the signals are refreshed every six hours.

Threat Center

Early warning for zero-days and new CVEs

The Threat Center matches new CVEs in real time against the technologies you actually run, verifies exploitability automatically and reports what is confirmed.

Start free trial Run the exposure check

Early warning47 min ago

CVE-2024-21762FortiOS SSL-VPNCritical

CVE published08:12
2 assets in your inventory affected09:00
Confirmed by PoC scan09:26
Alert sent to Microsoft Teams09:27

Visuals show sample data.

matching of new CVEs against your inventory: real time
CVEs in the threat feed, updated daily: 140,000+
of them with a known public exploit: 26,000+
CISA KEV entries flagged automatically: 1,000+

Matched against what you actually run

The basis is your technology inventory from external scans, Sentry and cloud connectors. Anything that does not match product and version never reaches you.

Inventory matchreal time

CVE-2024-21762FortiOS SSL-VPNCritical

Matching technologies in your inventory

vpn.beispiel-gmbh.atFortiOS 7.0.12Affected

remote.beispiel-gmbh.atFortiOS 7.0.12Affected

fw.beispiel-gmbh.atFortiOS 7.4.3Not affected

Alerts from CVSS 7.0, 3 technologies muted

Visuals show sample data.

Real-time CVE matching
New entries from NVD, VulDB and other sources checked against your technologies.
Threshold per workspace
Alerts from a CVSS score of your choice, 7.0 by default.
Security advisories
Vendor notices as a separate feed, filtered to your inventory.

Verified automatically, not just suspected

A version match is a suspicion. A targeted verification scan against the affected system turns it into confirmed or not confirmed.

Threat statusPoC verification

3Potential

1Verifying

1Confirmed

1Not confirmed

CVE-2024-21762vpn.beispiel-gmbh.atConfirmed

CVE-2024-21410mail.beispiel-gmbh.atVerifying

CVE-2024-23897wiki.beispiel-gmbh.atNot confirmed

Check template availableVerify now

Visuals show sample data.

Clear states
Potential, verifying, confirmed, not confirmed, expired or dismissed.
Verify now
Trigger the verification scan yourself with one click at any time.
Exploitability in context
EPSS, CISA KEV with due date, exploits, CVSS v3/v4 and the fixed version.

Prioritised and with the right team

Confirmed threats arrive with context where your team already works.

Fix firstsorted by risk

1CVE-2024-21762vpn.beispiel-gmbh.atKEV

2CVE-2024-21410mail.beispiel-gmbh.atKEV

3TLS 1.0 enabledshop.beispiel-gmbh.atMedium

Notification policies3 active

CriticalThreat intelligenceMicrosoft Sentinel and push to the SOC

HighVulnerabilitiesJira ticket for the platform team

MediumDark webEmail to the helpdesk

Escalation at EPSS above 0.80 with exploit

AI explanationself-hosted LLM

CVE-2024-21762vpn.beispiel-gmbh.atKEVCritical

Root cause: Outdated FortiOS version on the SSL VPN gateway.
Impact: Attackers can execute code without logging in.
Remediation: Update to FortiOS 7.0.14 or later.

Visuals show sample data.

Frequently asked questions

: An early warning system reports newly published vulnerabilities (CVEs) and vendor advisories that affect the technologies you use, before the next regular scan finds them. The decisive part is matching against your own inventory: only then do the thousands of CVEs per month shrink to the few that actually concern you. The blacklens.io Threat Center performs this matching in real time and then checks exploitability automatically.
: New CVEs are matched against your technology inventory in real time. EPSS, KEV and exploit signals are refreshed every six hours, and alert delivery runs every five minutes. Between publication of a CVE and your alert there are usually only minutes, depending on when the sources publish the entry.
: A hit in the version match is initially a potential threat. If a matching check template exists, blacklens.io automatically launches a targeted scan against the affected system (state: verifying). If the vulnerability can be demonstrated, the threat changes to confirmed; otherwise to not confirmed. Threats that are no longer relevant expire or are dismissed by your team. With "Verify now" you can trigger verification manually at any time.
: Newsletters and CERT warnings are generic: you have to check yourself whether and where the named product runs in your environment. The Threat Center knows your inventory from external scans, Sentry and cloud connectors, filters by product and version, adds EPSS and CISA KEV and verifies the hit by scan. You get a list of affected hosts instead of a link to read on.
: Yes. Notification policies filter by severity and alert type and define recipients in the workspace as well as integrations, for example critical threats to Microsoft Sentinel and as push notifications to the SOC, medium ones as a Jira ticket for the platform team. Below the CVSS threshold, 7.0 by default, no alert is created. With EPSS above 0.80 and an available exploit, an alert is escalated automatically, and alerts that are no longer relevant expire after 30 days.
: Among others NVD, VulDB, EPSS (FIRST), VulnCheck including CISA KEV, public exploit and PoC sources and DarkFeed. The signals are merged per CVE: EPSS score and percentile, KEV inclusion with due date and ransomware flag, exploit availability, CVSS v3 and v4, CWE and fixed version. New CVEs are matched against your inventory in real time, and the signals are refreshed every six hours.

Hear about the next critical CVE first.

14 days free. The Threat Center is active from the first scan, as soon as your technology inventory exists.

Try free for 14 days Book a demo

14 days free, all features
No credit card required
We walk you through your first findings

Early warning for zero-days and new CVEs

Matched against what you actually run

Verified automatically, not just suspected

Prioritised and with the right team

Frequently asked questions

Related solutions

Hear about the next critical CVE first.