Every vulnerability management program eventually runs into the same question: of the thousands of findings in the queue, which ones are attackers actually using right now?
CVSS cannot answer that. EPSS gets closer by predicting exploitation probability, and the CISA KEV catalog confirms a subset of known-exploited CVEs. But teams have been stitching those signals together manually, or worse, treating a 9.8 with no known exploit the same as a 7.5 that ransomware crews are actively weaponizing.
DefectDojo Pro closes that gap. Threat Intelligence brings exploit availability, known exploitation, and threat-actor activity directly into the platform as a first-class input to Priority and Risk. No lookups, no spreadsheets, no separate feed to correlate.
Every finding with a CVE is matched nightly against a curated intelligence feed built from CISA KEV, Metasploit, Exploit-DB, Nuclei templates, and public proof-of-concept tracking. When exploit evidence exists, the finding displays a Threat Intelligence card showing:
This is not just a badge on a detail page. The intelligence becomes a working surface across DefectDojo:
DefectDojo's Priority engine already combined severity, business context, and an external score built from EPSS and KEV. Threat Intelligence generalizes that external score. Each kind of exploit evidence acts as a floor on the EPSS scale:
|
Evidence |
Priority floor (EPSS-equivalent) |
|---|---|
|
Active exploitation plus ransomware or named actor |
45% |
|
In CISA KEV and used in ransomware |
30% |
|
In KEV or exploited in the wild |
20% |
|
Weaponized public exploit (Metasploit / Exploit-DB) |
15% |
|
Nuclei detection template exists |
12% |
|
Public proof-of-concept only |
8% |
|
No exploit evidence |
No change |
The finding's external score becomes the greater of its EPSS-derived value and the highest applicable evidence floor. Intelligence only ever raises a score, never lowers it. A finding whose EPSS already exceeds the floor is unaffected, and the per-product-type external-score scalar in your Prioritization Engine settings scales this contribution exactly as it always scaled EPSS and KEV.
The floors above raise Priority proportionally to a finding's base severity. That leaves an edge case worth stating plainly: a Low-severity finding with a CVE that is being exploited in the wild would receive only a small absolute bump and could still land in a low Risk band. Most security teams consider that wrong.
So there is a second, categorical rule. When threat intelligence reports active exploitation in the wild, the finding's Priority is raised to at least the level of a configured Risk band, regardless of what the weighted calculation alone produced. It ships set to Needs Action, and each product type can raise it to Urgent, lower it, or clear it to switch the floor off entirely.
Like everything else in this feature, the floor only ever raises. It never moves a finding down, and a finding that already scores higher on its own is untouched. Because it applies at the Priority level, the Risk band and Risk score follow automatically, so every list, filter, chart, and SLA calculation sees the same consistent number.
Threat intelligence is matched by CVE. Many findings have no CVE: most SAST results, secrets, misconfigurations, and custom rules. No vulnerability-instance threat intelligence exists for them anywhere, from any vendor.
DefectDojo handles this honestly. Those findings keep their exact current Priority and Risk, remain prioritized by every other engine input (severity, business criticality, exposure, and so on), and display a clear "no CVE to match against" message that is distinct from a CVE finding that simply has no known exploit yet.
One consequence worth knowing: in a mixed queue, as CVE-bearing findings gain exploit evidence, no-CVE findings will drop in relative rank even though their scores are unchanged. That is the intended behavior, and it reflects reality.
Prioritization data that attackers could tamper with, or that bounces your queue around every night, is worse than no data. Threat Intelligence was designed against both failure modes:
Cloud instances need no configuration. Self-hosted instances have three options:
Threat Intelligence ships off by default. Administrators can enable it directly, or first run it in shadow mode, which computes the would-be scores without changing anything live and produces a drift report showing exactly which findings would move. For large instances, contact support for the recommended rollout.
If your team is still cross-referencing KEV in a browser tab while your findings queue sorts by CVSS, this feature exists to end that. The evidence attackers care about now lives where your prioritization happens.
Learn more in the Threat Intelligence documentation, or contact us to see it in action.