Resources
How to read what Exploit Hound tells you.
Security tooling earns trust by being precise about what it knows. These are the words we use and what each one is allowed to mean.
Terminology
| Term | What it means |
|---|---|
| Detected | Evidence indicates the exposure likely exists. |
| High confidence | Multiple reliable signals support the finding. |
| Safely validated | An approved non-destructive check confirmed the exposure. |
| Potential attack path | Graph analysis indicates a possible route through related exposures. |
| Validated evidence | The stored artefact — a probe result, a banner, a negotiated protocol — behind a claim. |
Two words we do not use loosely: compromised is reserved for cases where evidence actually proves compromise, and exploited is reserved for cases where validation or evidence actually proves exploitation. Graph analysis alone never earns either word.
How the risk score is built
The Exploit Hound Risk Score runs 0–100 and is always the sum of named factors.
| Factor group | Inputs |
|---|---|
| Base severity | CVSS where available, otherwise scanner severity |
| Exploitation likelihood | EPSS, CISA KEV listing, public exploit availability |
| Exposure | Internet reachability, exposure category |
| Business context | Asset criticality and role |
| Connectivity | Number of attack paths the finding participates in |
| Observed activity | Threat intelligence matches and deception interactions on the asset |
| Evidence strength | Detected, high confidence or safely validated |
| Ageing | How long the exposure has been open, and whether it has been reopened |
| Compensating controls | Recorded risk acceptance or operator flag, which reduce the score |
Every scored finding stores the factor list and the scoring version used, so a score can still be explained after the methodology changes.
Releases
Exploit Hound ships continuously. The version badge in the corner of this site shows the release currently running on the platform.
Release notes for each version are available in the console under Changelog, and customers on a support agreement receive a summary of security-relevant changes with each release.
What Exploit Hound will not do
This is a defensive platform for systems you own or are authorized to assess.
Validation is read-only
Automated verification is limited to non-destructive checks: connectivity tests, protocol negotiation, configuration confirmation and banner reads. No payloads, no persistence, no configuration changes, no credential dumping.
Scope is enforced
Assets must be marked authorized before they can be re-checked, verification targets are derived from the asset record rather than from the request, and loopback and cloud metadata addresses are refused outright.
Start with what's actually exposed.
Point Exploit Hound at the assets you are authorized to assess and see the connected picture — not another list.