A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A CVE, or Common Vulnerabilities and Exposures identifier, is a unique public reference number assigned to a specific, publicly disclosed security vulnerability. The format is CVE-YYYY-NNNN, and the system is coordinated by MITRE. CVEs give vendors, researchers, and defenders a shared name for the same flaw.
When a CVE is published it usually appears in the National Vulnerability Database (NVD) with details, affected products, and a CVSS severity score. Scanners and patch tools key off CVE IDs to tell you what you are exposed to.
A CVE identifies the flaw but does not by itself measure its danger; that is what the CVSS score adds. traztech's founder has five published CVEs, including CVE-2024-45163, a CVSS 9.1 kill-switch for the Mirai botnet.
traztech delivers security research and CVE disclosure for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
CVEs show up in three places in a compliance programme: scanner output, vendor advisories, and the question of whether you patch inside your own stated timeframe.
The number itself is only an identifier. What matters for a control is whether you learned about it, decided how it applied to you, and acted within the window your policy commits to.
CVE Numbering Authorities, coordinated by MITRE. Vendors, research organisations and coordination centres can all act as CNAs.
No. CVEs cover publicly known vulnerabilities in released software. An issue in your own unreleased code or configuration will not have one, which is why scanner output is not the whole picture.