Considering an enterprise intelligence contract when what you need first is a defensible order for your CVEs?
Free plan: 500 CVEs a month, no sales call.
Flashpoint VulnDB is enterprise vulnerability intelligence within Flashpoint's Ignite threat-intelligence platform, covering many vulnerabilities that never receive a CVE ID. DevSecure Intelligence is a self-serve prioritisation API for CVEs: you send CVE IDs and get a ranked, explained answer, with the formula published.
Flashpoint details from Flashpoint's public material, last reviewed 21/10/2026 (sources below).
DevSecure capabilities shown in this comparison reflect the DevSecure Intelligence launch specification. Commercial availability may vary by plan and rollout status.
| Dimension | DevSecure Intelligence | Flashpoint (VulnDB) | Why it matters |
|---|---|---|---|
| Core purpose | CVE prioritisation: a ranked, banded answer with the evidence behind each rank | Vulnerability intelligence (VulnDB) as part of the Ignite threat-intelligence platform | Decide whether you need a ranking engine or a broad intelligence platform. |
| Coverage | CVEs, enriched from NVD, MITRE, EPSS, CISA KEV, GHSA, OSV, Exploit-DB and Metasploit | 415,000+ vulnerabilities, including 105,000+ not in NVD and 800+ exploited without CVE IDs (Flashpoint's figures) | If much of your estate has issues that never get a CVE, VulnDB covers ground we do not. |
| Scoring | One published formula per CVE (CVSS, EPSS percentile, KEV) with band thresholds, the KEV floor and the EPSS gate documented | Ransomware Likelihood and Social Risk scores; we found no published weighting | A reproducible score is one you can recompute and defend in an audit. |
| Explanation per CVE | Signal values, source timestamps and what would change the priority, on every record | Rich entry detail (60+ data points per entry, per Flashpoint) and analyst research on request | Explanations attached to the rank speed up review and challenge. |
| Pricing | Published plans, including a free tier | Quote-based; AWS Marketplace lists Ignite Vulnerability Intel at $80,000 for 12 months (up to 5,000 employees) | Predictable costs and no procurement cycle for a first evaluation. |
| Getting started | Self-serve: sign up, create a key, call the API; or try the demo with no key | Sales-led: demo, then a trial or proof of concept | Self-serve lets engineers evaluate on their own data the same day. |
| Threat intelligence | Not offered: we are a prioritisation engine, not a threat-intelligence platform | A 3.6 PB collection from illicit communities, and analyst requests for information | If you need dark-web and adversary research, Flashpoint provides it and we do not. |
| Integrations | REST API, OpenAPI and Postman; CI/CD gate for GitHub Actions and any CI | REST API; integrations including ServiceNow (Flashpoint VulnDB app) and Brinqa (VulnDB connector) | Pick the delivery that matches where decisions are made. |
Try the API in the browser with no key, then create a free key and send your own CVE list to POST /api/v1/prioritize. Every result shows the score, the band, the rule that set it and the inputs, so the order can be checked rather than trusted.
curl -X POST https://api.intelligence.devsecure.io/api/v1/prioritize \
-H "Authorization: Bearer $DEVSECURE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"cve_ids": ["CVE-2021-44228", "CVE-2024-3400"]}'{
"ranked": [
{
"rank_in_request": 1,
"cve_id": "CVE-2021-44228",
"rps_score": 105.0,
"priority_band": "critical_priority",
"recommended_next_step": "review_against_internal_sla"
},
...
]
}RPS = [(0.4 × CVSS/10) + (0.3 × EPSS percentile)] × KEV amplifier × 100
The KEV amplifier is 1.5 for CVEs in CISA KEV, otherwise 1.0. A KEV-listed CVE is never below High, and neither is one with an EPSS percentile of 0.99 or more and CVSS 9 or more. Full detail: methodology. API: prioritise scanner output.
Flashpoint is a strong choice for large security organisations that need vulnerability intelligence beyond CVE, dark-web collection and analyst research in one contract. DevSecure Intelligence does not try to replace that. It is for teams that need a transparent, reproducible order for their CVEs without a sales cycle.
Not for everyone. If you rely on VulnDB's coverage of vulnerabilities without CVE IDs or on Flashpoint's threat intelligence, keep it. DevSecure Intelligence ranks CVEs with a published, explainable score and can sit alongside it.
RPS combines CVSS, the EPSS percentile and CISA KEV with published weights; KEV-listed CVEs are never below High, and neither are CVEs with an EPSS percentile of 0.99 or more and CVSS 9 or more. The full method is on the methodology page.
No. We prioritise CVEs, enriched with GHSA and OSV advisories that reference them. Flashpoint states coverage of vulnerabilities that never receive a CVE ID.
Yes. The Free plan includes 500 CVEs a month with one API key. Paid plans are listed on the pricing page.
Send the CVEs you already have and get a ranked answer with the evidence for every rank. Your organisation applies its own SLA.
Flashpoint (VulnDB) is a trademark of its owner, used here only to identify the product compared; no affiliation or endorsement is implied. Figures attributed to Flashpoint are Flashpoint's own claims. Something out of date? Report an inaccuracy or email legal@devsecure.io. Changes since publication: changelog.