Know what’s exploitable in your environment, and what to act on first
Five checks on every finding, ranking by real attack paths, and proof without touching production.
Five checks behind every verdict
- Code present and callable?
- Configuration exploitable mode?
- Deployment allows the exploit?
- Network reachable?
- Runtime feature active?
If any check fails, the chain doesn’t hold and the vulnerability can’t be exploited on that resource.
Five checks, on each resource
Most tools check one or two. Defendermate checks all five.
Code
Confirms the vulnerable function or module is built in and callable.
Configuration
Reads the real service configuration. Off means ruled out.
Deployment
Checks capabilities and runtime policies against what the exploit needs.
Network
Combines topology with the on-resource checks. Both must hold.
Runtime
Checks which features of the package are actually running.
How this compares with most tools
| Check | Most tools |
|---|---|
| Code | Scanners match package versions. A version match doesn’t mean the code path is live. |
| Configuration | Scanners see the package, not the configuration that decides whether it can be exploited. |
| Deployment | Runtime tools confirm the process runs, not whether its security context permits the exploit. |
| Network | Topology tools flag reachable resources without checking exploitation conditions. |
| Runtime | Runtime scanners confirm the package is loaded, not which features are active. |
Verdicts you can audit
Each shows which check decided it, the evidence, and when it was checked. Out-of-date verdicts revert to Unknown.
Exploitable
All five checks hold, with evidence for each.
Not exploitable
At least one check ruled out by strong evidence.
Unknown
Not enough evidence yet, with the reason and what would settle it.
Ranked by the attack paths they open
Exposure
Only verified-exploitable vulnerabilities create a step in a path. Shortest routes to your most valuable assets rank first.
Blast radius
Measured by what an attacker gains at each step, not by counting connected resources.
Scores
Signals from your environment combined with CVSS, KEV and EPSS.
Proven safely on production
The validation agent (coming soon) walks each path that matters, changes nothing that persists, and never fires an exploit.
- Confirmed
- Blocked by a control
- Not allowed by your policy
- Waiting for your approval
Want exploit-level testing? Export the ranked plan to your own testing tools and bring the results back as evidence.
See which findings are exploitable in your environment
Connect read-only in minutes. Free to start.