DevSecure Intelligence vs a DIY CVSS + EPSS + KEV script
CVSS, EPSS and CISA KEV are free, and our scoring formula is published. You can combine them yourself in a spreadsheet or a short script. This page sets out what that gives you, and what you would be running to keep it right every day.
The formula is free to reuse
RPS = [(0.4 × CVSS/10) + (0.3 × EPSS percentile)] × KEV amplifier × 100
The KEV amplifier is 1.5 for CVEs in CISA KEV, otherwise 1.0. A KEV-listed CVE is never below High, and neither is one with an EPSS percentile of 0.99 or more and CVSS 9 or more. Weights, bands and rules: methodology.
Build it or use it
Every DevSecure score is built from 9 live sources, each kept current on its own schedule: NVD, MITRE CVE, FIRST EPSS, CISA KEV, GitHub advisories, OSV, Exploit-DB, Metasploit, FreshFixes.
DevSecure capabilities shown in this comparison reflect the DevSecure Intelligence launch specification. Commercial availability may vary by plan and rollout status.
| Task | DIY script | DevSecure Intelligence |
|---|---|---|
| Score a CVE | A few lines: CVSS, EPSS percentile and a KEV lookup, with our published weights or your own | RPS from the published formula, with the band and the rule that set it |
| Keep the inputs current | Download NVD, EPSS and KEV every day; handle rate limits, late files and failed loads | Nine live sources kept current on their own schedules, with retries and checks before data is used |
| Exploit and patch evidence | Add Exploit-DB, Metasploit and fix-commit data yourself, each with its own format and licence | Exploit-DB and Metasploit evidence where it exists; patch evidence on Business and Enterprise |
| Explain a rank | Write your own explanation for reviewers and auditors | The rule applied, the signal values, the data date and what would change the priority |
| History | Store daily copies yourself if you want to show what a score was on a given day | Every CVE's Final Priority stored daily since 21 Oct 2026 |
| Licensing | Track each source's licence and attribution terms | Per-field source and licence in every record |
| Use it in pipelines | Write and maintain the integration | REST API, OpenAPI, an MCP server and a CI/CD gate with VEX support |
A DIY script is enough when
- You only need a rough first sort of a short list, now and then.
- You already run a data pipeline and want full control of the weights.
- Your scanner's built-in score is enough for your team's decisions.
DevSecure Intelligence fits when
- You want the ranking without running and monitoring nine data loads.
- Reviewers or auditors ask why a CVE was ranked where it was.
- You want the same answer in scripts, CI, dashboards and AI agents.
Questions
- Is the RPS formula really free to reuse?
- Yes. The weights, the KEV amplifier, the EPSS gate and the band rules are on the methodology page so that anyone can check or recompute a score.
- What does a DIY script usually miss?
- The operations: late and failed source loads, history of what a score was on a given day, exploit and patch evidence, licensing terms and an explanation reviewers accept.
- Can I start with DevSecure for free?
- Yes. The Free plan includes 500 CVEs a month with one API key, and the demo works without a key.
Keep the formula, skip the pipeline
Send your CVE list, get a ranked answer with the reason for every rank. Your organisation applies its own SLA.
Other comparisons: all products.