Discover
Evidence Surface maps your full external perimeter from the Evidence Graph, our live model of the entire internet. Your complete inventory is ready in seconds, including the assets your current tools have never seen.
See your whole attack surface.
Know your cyber risk in dollars.
Say hello to warranty-backed cyber loss protection.
40% more assets. Results in seconds. Scan your domain against a pre-indexed map of 6 billion internet assets.
Your backlog has never hit zero.
It never will.
Every scanner hands your team an open-ended list, sorted by severity scores that were never designed to predict cost.
Some of the most expensive breaches in history came from CVEs rated medium.
AI-assisted discovery is about to push the list from 40,000 CVEs a year past 200,000…
…and sorting by score was already failing at 40,000.
And after all that patching, you can't prove what it was worth.
Your team fixes vulnerabilities all year.
Your board decides in dollars.
How much money did your security program save the company this year?
Almost no security leader can answer.
The FIRE list: the only CVEs that have actually cost money.
The FIRE list: the only CVEs that have actually cost money.
A FIRE is a CVE that caused a documented financial loss at a real organization. We built the list from insurance claims, DFIR forensic records, reinsurer tables, and public disclosures. If a CVE is on this list, someone lost money to it. If it's not, no one ever has.
Your team gets a list it can finish: most first scans turn up single-digit FIREs. And every finding shows a dollar figure from loss data for your industry and size, so the work finally has a number behind it. New loss data can add new FIREs to the list.
Discover, scan, prove, cover.
Scan
Evidence Scan checks every asset, every 24 hours, against the FIRE list, plus KEVs and any custom lists you run. Each finding comes with its dollar exposure.
Prove
Evidence Reporting turns the results into board-ready summaries that export to slides or email: exposure in dollars, risk retired in dollars, and the streak once you hit zero.
Cover
Evidence Warranty backs the whole chain with up to $5M, because our platform is accurate enough to stake money on.
Every piece of Evidence is a first.
Evidence Surface: the first pre-built EASM.
Companies get breached through assets they didn't know they owned. We mapped the whole internet and resolved who owns what, so your attack surface is ready before you log in, including the 40% of assets mature security teams missed in our customer testing. New assets flow in as your footprint changes, and acquisitions show up without reconfiguring anything.
Evidence Scan: the first scanner built on financial loss data.
Every severity score is a proxy for one binary question: has this ever cost someone money? Scan answers it directly, every day, on every asset. Most first scans turn up single-digit FIREs. Zero is within reach, and we track your streak once you get there.
Evidence Reporting: the first security reports in dollars.
How much financial risk has your program eliminated this year? Evidence tracks every dollar you remediate: a risk-retired total that climbs with every fix, exposure by business unit, and peer rankings built from what those companies actually lost. Walk into the board meeting speaking dollars and cents.
Evidence Warranty: the first warranty in vulnerability management.
We'll bet $5M we know which CVEs cause financial loss. Every vendor says they know which vulns matter, but Evidence is the first vulnerability management company to put its money where its mouth is. Lose money to a CVE that isn't on the FIRE list, and we pay you up to $5M.
“We've fixed every vulnerability that has historically caused financial loss. If we're breached, it would be a first-of-its-kind event.”
With Evidence, you can say that to your board, and back it with a $5M warranty.
Who needs Evidence?
Enterprise
CISOs average 18–26 months in the job while the rest of the C-suite gets four years. Breaches are one reason. The bigger one is having no way to show leadership what the program is worth. Evidence stops the breaches that cost money and proves you did it, in dollars, with up to $5M in coverage while you do.
For enterprise →Insurance carriers
Questionnaires self-report and ratings tools guess. Evidence shows you any applicant's real footprint before you bind, audits the application against their real perimeter, and monitors your whole book daily against the CVEs that generate claims. When a new CVE is used to cause a breach, you learn right away which insureds are exposed to the same CVE.
For carriers →MSSPs and MDRs
Clients leave when they get breached or can't see what they're paying for. Evidence handles both: catch the FIREs before they end the contract, and walk into every QBR with the dollars of risk you retired. Onboarding a new client is as simple as typing their domain.
For MSSPs →
We kept asking
why no one had built this.
So we built it.
Their last company was acquired by Tenable. That's when they started asking the question that became Evidence: which vulnerabilities actually cost money?
Jeremiah Grossman CEO
Hacked Yahoo as a teenager; founded WhiteHat Security, and has argued vendors should warranty their findings since 2014.
Robert Hansen CTO
Built the anti-fraud systems at eBay that ended up in every major browser, then spent a career breaking into banks and inventing attack techniques.
Lex Arquette CPO
Co-founded WhiteHat and Bit Discovery and built the growth systems that onboarded Facebook's first billion users.
Heather Konold COO
Scaled operations and led M&A at both companies.
See the Evidence for yourself.
Start with one domain. We'll find the rest, and show you what's exposed, what's vulnerable, and what it could cost you.
Request a demo