Software changes after a product ships. KONFORMA keeps checking every component in every release against OSV, NVD and CISA KEV, and puts actively exploited findings at the top, not buried in a scanner report.
Components are checked against OSV.dev, NVD and CISA’s Known Exploited Vulnerabilities catalog, so you get both breadth of coverage and a clear signal for what’s actively being exploited.
A CVE with a CVSS 9.8 that nobody is exploiting is not the same emergency as a CVE with a 6.5 score that’s on the CISA KEV list. KONFORMA ranks by real-world risk, not score alone.
New vulnerabilities are checked against your inventory continuously, daily or even every few hours on higher plans, for as long as a release is in the field.
Instead of a dashboard full of metrics, you get a to-do list: the handful of findings that actually need a decision this week.
Depending on your plan, from weekly up to every six hours, continuously for as long as a release stays active in your portfolio.
A finding confirmed via CISA’s Known Exploited Vulnerabilities (KEV) catalog. Those are flagged separately from the general OSV/NVD findings list.
Yes. Decisions and VEX-style statements are recorded per release, so you have a record of why a finding was or wasn’t treated as a risk.