cvENGINE Launches as an Open-Source, AI-Driven External Attack Surface Assessment Tool

Overview of cvENGINE

cvENGINE has been introduced as a self-hosted, open-source external attack surface assessment platform. The project combines asset discovery, vulnerability scanning, and threat feeds into a continuous loop. According to the project documentation on GitHub, the tool aims to help organizations identify exposed assets and prioritize vulnerabilities based on real-world exploitation data without requiring license fees or per-asset pricing.

Core Features and Capabilities

• Continuous Discovery: Automatically maps domains, subdomains, IPs, ports, products, versions, TLS configurations, and technologies into a centralized inventory.
• Exploitation Ranking: Categorizes CVEs into threat levels based on real-world exploitation sources and matches them against active inventory.
• AI Triage and Evidence: Combines AI triage with read-only validation checks to reproduce findings and record exact commands, aiming to reduce alert fatigue.
• Distributed Scanning with Sentinels: Allows users to deploy lightweight worker nodes called Sentinels inside or outside networks to distribute scanning workloads, including private IP ranges.
• Integrated Scanners: Incorporates tools like nmap, naabu, Nuclei, testssl.sh, and optional OpenVAS integration for comprehensive network testing.

Security and Deployment

Designed to run via Docker Compose on Linux servers (such as Debian or Ubuntu), the platform emphasizes local control and privacy. The documentation specifies that users must bring their own AI API keys or run local models.

• Safety Measures: Employs read-only checks, avoids default password guessing, and excludes loopback or cloud metadata addresses.
• Access Controls: Includes two-step authentication, IP allowlisting, and audit logs to secure administrative access.
• Licensing: Released under the GPL-3.0 license as a fork of reNgine 2.x.

Verification and Next Steps

Organizations interested in evaluating cvENGINE can review the official repository on GitHub (`hevnsnt/CVEngine`). Users are advised to verify installation requirements, review third-party credits, and ensure they have explicit authorization before scanning any target networks or assets.