CVE monitoring for SaaS and AI-built software, with human prioritisation
Dependabot and other scanners report every known vulnerability, but not which one actually affects you. Veriploy rates incoming CVE alerts by severity, exploitability and update path and tells you what is production critical and what can wait.
- Digest or critical alerts
- Human prioritisation
- Repo + CVE + infrastructure
- German point of contact
Technical point of contact
Timo Wevelsiep
Software engineer, cloud architect, founder & managing director
I review code, security and infrastructure and surface what is technically risky before launch, customer use or due diligence.
For questions like:
- Is this release ready for production?
- Which CVEs are really critical?
- Will the architecture carry the next users?
Why Dependabot and automated scanners alone are not enough
Automated scanners are a good start, but they report vulnerabilities, they do not prioritise them. To triage Dependabot alerts properly, you need more than a list. That is exactly where the problem begins:
What Veriploy rates for every CVE
We take each alert and line up the factors that decide real urgency. The result is a prioritisation instead of a list:
| Factor | Question | Why it matters |
|---|---|---|
| Severity (CVSS) | How bad would the damage be in the worst case? | A first rough assessment, but rarely decisive on its own |
| Exploitability (EPSS) | How likely is the flaw to be exploited in the wild? | Separates theoretical risk from an acute threat |
| Affected runtime | Is the vulnerable path reachable in your app? | Many CVEs affect code you never call |
| Transitive dependencies | Is the flaw in the package itself or deep in the tree? | Determines whether you can update yourself or have to wait |
| Update path | Is there a safe version, and how big is the jump? | Decides how fast a fix is even possible |
| Breaking-change risk | Does the update break your app? | Stops the fix from doing more damage than the flaw |
Critical alerts vs. monthly digest
Not every CVE needs a phone call, and no vulnerability should sit untouched for a month. So we draw a clear line between what demands an immediate reaction and what gets handled on a calm rhythm.
Critical alerts go out promptly: an actively exploited flaw in a reachable runtime reaches you as a notice with context, the affected path and a concrete recommendation, not as a raw scanner message. You know right away whether you need to act today or not.
Everything else is bundled into the monthly digest: low and medium findings, packages with an available but non-critical update, and pointers to dependencies you should replace over time. One report instead of dozens of single notices, with a clear order of what comes first.
Connection to Infrastructure Watch and repo review
CVE monitoring is not an isolated channel, it is part of continuous technical oversight. We always rate a vulnerability in the context of your infrastructure and your code, not just as an entry in a database.
Through the repo review we know which parts of your code actually use the vulnerable function. Through Infrastructure Watch we know whether the affected endpoint is publicly reachable, whether rate limiting applies and what the deployment looks like. Only that context turns a CVSS score into a reliable priority, the point where raw Software Composition Analysis (SCA) becomes a real prioritisation.
That is the difference from pure dependency scanning: instead of assigning a flaw a number in isolation, we place it in your concrete setup, from the affected line to the open port.
Example: 17 alerts, but only 2 production critical
A typical month in an AI-built SaaS app shows why the number of alerts says little. Of 17 notices, two remained after the assessment that truly mattered:
- 9 alerts hit dev dependencies that never run in production, no action needed
- 4 alerts sat in transitive packages whose vulnerable function the code never calls
- 2 alerts had a high CVSS but an EPSS near zero and no known exploit
- 1 critical alert: actively exploited flaw on a publicly reachable route, reported immediately
- 1 important alert: safe update available but with a breaking change, in the digest with a migration note
Which plan the CVE monitoring sits in
CVE monitoring is a fixed part of ongoing oversight. The depth depends on the plan, the prices are fixed and transparent.
| Watch 299 €/mo | Guard 749 €/mo | Launch 1.490 €/mo | |
|---|---|---|---|
| CVE monitoring | Monthly digest with prioritisation | Prompt critical alerts plus digest | Critical alerts plus prioritised release review |
| Reaction | Bundled in the monthly report | Direct notice on acute flaws | Support before every larger release |
| Context | Severity and update path | Plus exploitability and affected runtime | Plus breaking-change review in the release plan |
| Sparring | Async, on the report rhythm | Direct channel for follow-up questions | Close exchange around releases |
| Best for | Apps with a calm change rate | Products with real users | Teams shortly before or after launch |
What a finding looks like
CVE in the HTTP parser library, actively exploited (high EPSS), vulnerable path reachable via a public route. Recommendation: apply the safe patch release immediately, then run a regression test on the route.
Raw scanner alert or prioritised monitoring?
| Scanner alert only | Veriploy CVE monitoring | |
|---|---|---|
| Result | A list of all known vulnerabilities | A prioritised order by real risk |
| Exploitability | CVSS score without context | CVSS plus EPSS and known exploits |
| Affected runtime | Not considered | Checks whether the path is reachable in your code |
| Update path | Version jump without assessment | Safe update plus breaking-change risk |
| Reaction | Every alert equally loud | Critical immediately, the rest bundled in the digest |
Frequently asked questions
Does this replace existing scanners and Dependabot alerts?
No, it builds on them. Dependabot and other scanners can keep running and reporting vulnerabilities. Veriploy takes those alerts, rates them by exploitability, affected runtime and update path, and turns a list into a prioritisation. You keep your tools and gain a human judgement on top.
How fast do I get a notice on a critical CVE?
For acutely exploited flaws in a reachable runtime you get a prompt notice with context and a concrete recommendation on Guard and Launch. On Watch all findings come together in the monthly digest, because that plan is built for a calm change rate.
Do you also patch the CVEs yourselves?
Not within the plan. We assess, prioritise and explain the safe update path including breaking-change risk. Implementation runs through your team or separately through Wevelsiep Advisory or WZ-IT. That keeps the monitoring independent from the implementation.
What about transitive dependencies?
We look at those specifically. Many alerts sit deep in the dependency tree in packages you did not install directly. We check whether the vulnerable function is even reachable through your code and whether you can update yourself or have to wait for an upstream release.
How does this tie into Infrastructure Watch and the repo review?
We never rate a CVE in isolation. Through the repo review we know which code paths use the vulnerable function, through Infrastructure Watch whether the affected endpoint is publicly reachable. Only that context turns a score into a reliable priority.
What does the CVE monitoring cost?
It is part of ongoing oversight. Watch delivers the monthly digest for 299 € per month, Guard adds prompt critical alerts for 749 €, Launch adds the prioritised release review for 1.490 € per month. All prices are net plus VAT, plans cancellable monthly.
- Infrastructure audit for AI-built software, review your deployment, backups, monitoring and secrets
- Repo review subscription, a recurring senior look at code, CVEs and architecture
- Vibe coding security audit, plus ongoing control as the code keeps growing
- AI code audit in Germany: get repo, security, CVEs and infrastructure reviewed
Have your CVE alerts ranked, instead of just counted.
Start with Watch for the digest, or Guard for prompt critical alerts in the plan that fits.