Your scanners report findings. Your team fixes vulnerabilities. Those are not the exact same thing, and the gap between them is where security teams spend an enormous amount of time.
A single CVE can appear on ten thousand findings across your portfolio. Ask "is CVE-2021-44228 being exploited?" and a findings table gives you ten thousand answers to the same question. The Vulnerability Explorer in DefectDojo Pro collapses that noise: one row per vulnerability ID, with the threat intelligence that actually drives prioritization sitting right on the row.
DefectDojo Pro stores enrichment data once per vulnerability, then applies it to every finding that references it. A CVE seen on ten thousand findings is looked up once. The Vulnerability Explorer is where you inspect that data directly, without paging through findings one at a time.
Each row carries the same five threat intelligence columns you get on the findings table:
Because these values describe the vulnerability itself, they are identical no matter how many findings reference it. And each row's Total Findings count links straight to the findings list filtered to that vulnerability. You go from "this CVE is KEV-listed" to "here is everything it affects" in one click.
EPSS (Exploit Prediction Scoring System) is a data-driven model published by FIRST that estimates the probability a given CVE will be exploited in the wild within the next 30 days. DefectDojo Pro stores two values on every matching finding and surfaces both in the Vulnerability Explorer:
When a finding carries multiple CVEs, DefectDojo keeps the highest EPSS score and pairs it with that same CVE's percentile. The two are never mixed from different CVEs, because a percentile is only meaningful alongside its own score.
Sort the Explorer by EPSS Score descending and you have the fastest answer to "which vulnerabilities in my environment are most likely to be attacked?"
The CISA KEV catalog is the U.S. government's authoritative list of vulnerabilities confirmed to have been exploited in the wild. Where EPSS is a prediction, KEV is a statement of observed, real-world exploitation. DefectDojo Pro tracks three KEV values per vulnerability:
Both sources sync automatically once per day, and a Sync KEV/EPSS data button at the top of the Vulnerability Explorer lets you pull the latest data on demand. A CVE added to the KEV catalog overnight flips your existing findings to Known Exploited on the next run. No re-import required. And if a CVE is removed from the catalog, DefectDojo clears the stale values rather than leaving them set.
KEV can also tighten your remediation deadlines. With Cap by KEV due date enabled in your SLA configuration, a KEV-listed finding's SLA deadline is pulled in to CISA's remediation due date for that CVE.
The Explorer draws a line most tools blur. A red ✗ under Known Exploited means the vulnerability was checked and CISA does not list it. A blank column means the vulnerability has never been enriched, so its exploitation status is simply unknown.
That distinction matters. "We have not looked yet" and "we looked and it is not exploited" would otherwise be indistinguishable, and only one of them is a reason to relax.
Not every finding carries a CVE. SCA tools and dependency scanners frequently report GHSA identifiers from the GitHub Advisory Database, and DefectDojo recognizes GHSA, GO, RUSTSEC, and other advisory prefixes as vulnerability IDs throughout the platform. Connectors for tools like Endor Labs map both CVE and GHSA identifiers onto findings at import.
One honest caveat: EPSS and KEV enrichment match strictly on CVE identifiers. A finding that carries only a GHSA identifier receives no EPSS or KEV data, because neither FIRST nor CISA keys on GHSA. The Vulnerability Explorer still tracks those identifiers as first-class rows; they just will not carry exploitation intelligence until a CVE is associated. Knowing which of your vulnerability IDs can be enriched, and which cannot, is itself useful triage information.
Knowing a CVE is exploited tells you what to fix first. Root cause analysis tells you how much one fix actually clears.
A vulnerable library pulled into forty services produces forty findings. Each is real, each is separately triaged, and each is resolved by the same single version bump. Root Cause Correlation in DefectDojo Pro makes that relationship explicit by grouping findings that share a root cause: the same component at the same version, the same CVE, the same infrastructure resource, or the same weakness class at the same URL.
The Root Causes page ranks these clusters by active findings, affected assets, and aggregate risk, so the largest, riskiest fixes surface first. Component and resource matches key on exact identifiers like the Package URL, and every cluster records the evidence that produced each link, so a judgement is never presented as an identity. When a component fix fully covers a CVE cluster, that CVE is marked covered and hidden from the default list, keeping the queue limited to work you can actually act on.
Correlation runs automatically after every import, and clusters feed back into prioritization: a root cause spanning many assets raises the priority of each member finding, because one fix clears all of them. Root Cause Correlation is currently in Beta and off by default; a superuser can enable it under Settings > Feature Flags.
Put the pieces together and a queue of thousands becomes a short list:
EPSS tells you what is likely to be attacked. KEV tells you what already has been. Root cause analysis tells you the single change that resolves the most of it. The Vulnerability Explorer is where all three meet.
EPSS/KEV enrichment and Root Cause Correlation are DefectDojo Pro features, fully managed on DefectDojo Cloud with nothing to install or schedule. See the EPSS/KEV documentation and Root Cause Correlation documentation to get started, or request a quote of DefectDojo Pro.