Is EchelonGraph the fastest CVE feeder?

We cannot say: our measurement compares EchelonGraph with NVD, and with no other feed. Against NVD: Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09). Against the CVE List itself no copy can be ahead, EchelonGraph included, because it is the source. As a CVE feeder EchelonGraph pulls directly from MITRE's cvelistV5 every 5 minutes and layers NVD, OSV, CISA KEV, EPSS, and GHSA plus 9 vendor PSIRTs on top, with per-asset attribution.

Why does NVD usually publish a CVE after EchelonGraph has it?

NVD republishes the records CNAs publish to the CVE Program, on its own schedule; EchelonGraph reads the CVE Program's cvelistV5 repository directly, every 5 minutes. Measured: Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09). On the other 813, NVD published first, a median 87.8 min before our record. NVD's analysis — CPE matching, CVSS validation, CWE review and reference tagging — is a separate step that comes after NVD publishes the record, and its 2024 backlog left many records waiting months for it. EchelonGraph upserts NVD's analysis when it lands.

What data sources does EchelonGraph aggregate?

Seven distinct upstream sources, keyed by CVE-ID: (1) MITRE cvelistV5 GitHub commits, every 5 minutes — the fast path. (2) NVD REST API — the deep-enrichment path with analyst-validated CPE and CVSS. (3) GitHub Security Advisories (GHSA) — npm, PyPI, Go, Maven, RubyGems ecosystem detail. (4) Google OSV — open-source vulnerability database across multiple ecosystems. (5) CISA KEV (Known Exploited Vulnerabilities), checked every 5 minutes — flags CVEs being exploited in the wild. (6) EPSS (Exploit Prediction Scoring System) from FIRST, daily — exploit-probability score 0-1. (7) Advisories from 9 vendor PSIRTs — Red Hat Product Security (RHSA via CSAF), Microsoft Security Response Center (MSRC), Cisco PSIRT, GitLab, AWS Security Bulletins, Palo Alto Networks, Google Cloud, HashiCorp, Grafana Labs — linked to the CVEs they name. Conflicts on the cves row resolve via a `modified` timestamp freshness gate so stale re-fetches are no-ops.

How does EchelonGraph connect CVEs to my specific assets?

EchelonGraph's three-tier scanner stack discovers assets (Tier 1 cloud-native APIs, Tier 2 on-prem network crawl, Tier 3 in-cluster Kubernetes agent) and represents them as nodes in a per-tenant graph. An internal matcher checks new CVEs against the asset and software inventory EchelonGraph already holds for you — by package, image, or CPE tag — and on a match writes a findings row, emits a per-tenant NATS alert, and surfaces it on the Attack Graph via the WebSocket bridge. We have not timed that match. Most CVE feeds give you a flat list — EchelonGraph tells you which of your assets is affected, not just that the CVE exists.

What is the EchelonGraph Score?

A 0–10 severity score with a confidence rating (HIGH / MEDIUM / LOW), set per CVE by a published rule cascade in which the first rule that applies decides the score. A CISA KEV listing puts it at 9.0 or above. Otherwise an EPSS exploit probability above 0.30 lifts the CVSS base toward 9.0. Otherwise it is the CVSS from GitHub's advisory (when that is at least the NVD/CNA score, or newer than the CVE record's last change) or from the NVD/CNA record; NVD's legacy CVSS v2.0 base, or a severity the vendor states in the CVE description, is the last resort. It does not lower a score for lack of exploitation: an unexploited 9.8 stays 9.8 unless a newer GitHub advisory revises the CVSS itself. Ranking by exploitation pressure is the job of EG Risk, a separate 0–100 priority (45% severity, 40% exploitation, 15% automatability) that separates equal-severity CVEs. A rejected CVE, or one no source has scored yet, carries neither number.

Measured against EchelonGraph's own record of the same CVEs: Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09). On the other 813, NVD published first, a median 87.8 min before our record. We have not measured NVD against the CVE List itself in the published run. NVD's analysis is a separate step after it publishes a record: CPE matching (converting CNA free-text affected-product strings into structured cpe:2.3 URIs with version-range trees), CVSS validation, CWE classification review, and reference-link tagging. These are real value-adds — analyst-curated CPE is what lets vulnerability scanners deterministically decide 'is this version affected?' — and in 2024 NVD's analysis backlog left many published records waiting months for them.

What is MITRE cvelistV5?

cvelistV5 is the canonical CVE-record format and the GitHub repository where every CVE Numbering Authority (CNA) publishes their vulnerability disclosures. When a CNA — Microsoft, Apple, Cisco, Red Hat, GitHub, or any of the ~400 other CNAs — assigns a CVE ID and submits a record via the CVE Services API, the record is published to github.com/CVEProject/cvelistV5. It contains the raw CNA disclosure (descriptions, affected products as free text, references, CVSS the CNA supplied, CWE classification). It does NOT contain NVD's analyst-curated CPE or validated CVSS — those are added later when NVD analyses the record. EchelonGraph polls cvelistV5 every 5 minutes, then upserts NVD's enrichment when it lands.

Can I get pre-NVD CVE access through EchelonGraph?

Usually. 'Pre-NVD' means a CVE that a CNA has published through MITRE's cvelistV5 but that NVD has not yet published or analysed. EchelonGraph's MITRE poller reads cvelistV5 every 5 minutes. Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09). Pre-NVD records carry the CNA's self-supplied CVSS (we tag the score's source as 'cna:\u003cvendor\u003e' on the detail page) and are surfaced with a 'Pre-NVD' badge so security teams understand they're seeing analyst-pending data. When NVD's analyst record lands later, EchelonGraph upserts the validated CVSS and CPE match without losing the original CNA attribution.

Is EchelonGraph an alternative to VulnCheck, Tenable, Rapid7, or Snyk?

EchelonGraph is complementary to those platforms on the CVE-feed axis, not a one-to-one replacement. VulnCheck and Mandiant focus on threat intelligence + exploit data. Tenable (Nessus, Tenable.io, VPR) and Rapid7 (InsightVM) are vulnerability scanners with their own prioritization scores. Snyk DB focuses on developer-tool SCA across language ecosystems. What EchelonGraph adds: CVE records read directly from MITRE cvelistV5 every 5 minutes, multi-source aggregation across 7 distinct upstreams in one row keyed by CVE-ID with a freshness-gated upsert, and per-tenant asset attribution that checks new CVEs against the assets and software it holds for you. Customers commonly run EchelonGraph alongside their existing scanner. We have measured EchelonGraph against NVD only, not against those platforms: We had 95.4% of the 17,558 new CVEs both we and NVD hold before NVD published them, with a median lead of 32.3 min on the 16,745 we had first (measured 2026-11-09).

CVE Pipeline Architecture

How fast EchelonGraph gets a new CVE, measured against NVD

EchelonGraph reads CVE records straight from MITRE's cvelistV5 repository, where CNAs publish them, every 5 minutes — the same records NVD republishes — and checks each one against the assets and software inventory it holds for you, not just a CVE ID. A scheduled weekly job compares when each new CVE's record was written in EchelonGraph with when NVD published it. In the latest published run: Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09).

The path a new CVE takes, and the interval we measure

Every hop from the moment a CVE Numbering Authority (CNA) publishes a vulnerability to the moment it appears on your Attack Graph. We time one interval end to end — our record's created_at against NVD's published — in the weekly measurement, measured 2026-11-09, over the 30 days to 2026-11-09. The run does not measure the time from a CNA's publication to our record, and it compares EchelonGraph with NVD only — not with any other provider.

The hops from CNA publication of a CVE to a customer's Attack Graph, and the measured interval between our record and NVD's publication.
Hop	When
CNA publishes via CVE Services API	the record's datePublished
Record is published to the cvelistV5 GitHub repo	the CVE Program's step
EchelonGraph MITRE poller reads cvelistV5	every 5 minutes
Postgres BatchUpsertConservative writes the row	its created_at
Matcher checks it against the asset and software inventory we hold for you	not timed
Per-tenant NATS alert published	not measured
WebSocket bridge → Attack Graph updates	not measured
Had the record before NVD published it (of the 17,558 new CVEs both we and NVD hold), measured 2026-11-09	95.4%
Median lead, on the 16,745 we had first, measured 2026-11-09	32.3 min
NVD's median lead instead, on the 813 where NVD was first, measured 2026-11-09	87.8 min

Other CVE providers: what we have measured, and what we have not

Where each provider takes its records from, and what our measurement says about it. Only NVD is measured (measured 2026-11-09); we state no lag for anyone else.

Source path of each CVE provider, and what our measurement says about it. EchelonGraph vs NVD-only, MITRE-only, VulDB, Snyk, and GHSA-only feeds; only NVD is measured.
Provider	Source path	What we measured
EchelonGraph	MITRE 5-min + NVD + OSV + KEV + EPSS + GHSA plus 9 vendor PSIRTs	the side we measure
NVD-only feeds	NVD /rest/json/cves/2.0 — analysis added after publication	NVD itself: after us on 95.4% of the 17,558 new CVEs both we and NVD hold
MITRE-only feeds	Raw cvelistV5 records — no CPE / no validated CVSS	not measured; the same source we read
VulDB	Scrapes CNAs + their own analysts	not measured
Snyk DB	Curated ecosystem advisories — analyst-gated	not measured
GitHub Advisories only	GHSA — ecosystem-only (npm / PyPI / Go / Maven / RubyGems)	not measured; ecosystem-only

NVD's row is NVD's own published timestamp, measured 2026-11-09; a feed that mirrors NVD cannot have a record before NVD publishes it. On the other 813, NVD published first, a median 87.8 min before our record. NVD's analysis (CPE, validated CVSS) comes after it publishes a record, and in 2024 its backlog left many records waiting months for it. MITRE-only feeds read the source we read: no copy of the CVE List, ours included, is ahead of the List itself.

What single-source providers can't do

Speed is only one axis — depth matters too. Here's what each source carries:

Capability matrix comparing EchelonGraph against NVD-only, MITRE-only, and VulDB across 9 dimensions including multi-source ingest, analyst-enriched CPE, KEV, EPSS, vendor PSIRTs, asset attribution, WebSocket push, and the EG Score with EG Risk.
Capability	EchelonGraph	NVD-only	MITRE-only	VulDB
First touch via MITRE cvelistV5 (polled every 5 minutes)	✓	—	✓	✓
Analyst-enriched CPE + validated CVSS	✓	✓	—	—
GHSA ecosystem detail (npm/PyPI/Go/Maven/RubyGems)	✓	—	—	—
CISA KEV exploit-in-the-wild flag	✓	✓	✓	—
EPSS exploit-probability score	✓	—	—	—
Vendor PSIRT advisories (9 vendors)	✓	—	—	partial
Per-tenant asset → CVE attribution	✓	—	—	—
WebSocket push to dashboard	✓	—	—	—
Confidence-rated EG Score + EG Risk priority	✓	—	—	—

Looking for a VulnCheck, Tenable, Rapid7, or Snyk DB alternative?

EchelonGraph is complementary to those platforms on the CVE-feed axis, not a one-to-one replacement. Most teams evaluating us are already paying for one of them and want to close a specific gap. Here's how to think about it:

VulnCheck alternative — CVE feed freshness + asset attribution

VulnCheck's strength is exploit intelligence and KEV-style early-warning feeds. Where EchelonGraph adds is reading MITRE's cvelistV5 directly, every 5 minutes, the multi-source record (NVD + GHSA + OSV + KEV + EPSS on one row per CVE, with advisories from 9 vendor PSIRTs linked to it), and per-tenant asset attribution that links new CVEs to the specific cloud / on-prem / Kubernetes assets they affect — not just a flat list. We have measured EchelonGraph against NVD, not against VulnCheck: We had 95.4% of the 17,558 new CVEs both we and NVD hold before NVD published them, with a median lead of 32.3 min on the 16,745 we had first (measured 2026-11-09).

Tenable / Rapid7 InsightVM alternative — pre-scan CVE intelligence

Tenable (Nessus, Tenable.io, VPR — Vulnerability Priority Rating) and Rapid7 InsightVM are scanner-first products with their own prioritization scores. EchelonGraph runs alongside your scanner: a new CVE reaches EchelonGraph from cvelistV5, which it reads every 5 minutes, and is checked against the asset and software inventory EchelonGraph already holds for you; we have not timed that match. We have measured EchelonGraph against NVD, not against Tenable or Rapid7: We had 95.4% of the 17,558 new CVEs both we and NVD hold before NVD published them, with a median lead of 32.3 min on the 16,745 we had first (measured 2026-11-09).

Mandiant alternative — CVE-side of vulnerability intelligence

Mandiant (now Google Cloud Threat Intelligence) is strongest on adversary intel, IOCs, and APT tracking. EchelonGraph isn't trying to be a threat-intel platform — we're the CVE-side of vulnerability intelligence: which CVEs were just disclosed, which of your assets are affected, and how severe each one is by a published rule over NVD, KEV, EPSS and GHSA. Customers commonly run both.

Snyk DB alternative — beyond developer-ecosystem SCA

Snyk DB is excellent for npm / PyPI / Maven / Go / RubyGems SCA inside a developer workflow. EchelonGraph already ingests GHSA (the same upstream Snyk uses for ecosystem data) and adds NVD, MITRE and advisories from 9 vendor PSIRTs, so infrastructure and appliance CVEs that ecosystem-only feeds miss are in the same feed — Palo Alto PAN-OS, Cisco IOS, VMware vCenter, F5 BIG-IP, HashiCorp Vault, Atlassian Jira / Confluence.

VulDB / NVD-only feeds — when you need pre-NVD CVE access

If you're relying on NVD's REST API or a feed that mirrors it, you inherit NVD's publication timing, and its analysis comes later still. EchelonGraph reads MITRE's cvelistV5 — the same feed CNAs publish to — every 5 minutes: Of the 17,558 new CVEs both we and NVD hold, published in the 30 days to 2026-11-09, we had 95.4% before NVD published them; on the 16,745 we had first, the median lead was 32.3 min (measured 2026-11-09). Records arrive with a clear "Pre-NVD" badge on the detail page so your team knows they're seeing CNA-self-supplied CVSS until NVD's analyst record lands and we upsert the validated CVSS + CPE match without losing the original CNA attribution.

How the architecture wins

1. Multi-poller, single-row upsert with freshness gate

Every source writes to the same cves row keyed by CVE-ID. A modified timestamp gates conflicts: MITRE wins first-touch (speed); NVD wins enrichment depth when its analyst lands (CPE, validated CVSS). Stale re-fetches become no-ops.

2. Direct CNA proximity

We watch the cvelistV5 GitHub commits — the same feed CNAs push to via the CVE Services API. NVD republishes those records on its own schedule, one step further downstream. That single architectural choice is the lead over NVD we measure: 95.4% of the 17,558 new CVEs both we and NVD hold, measured 2026-11-09. It is not a lead over the CVE List itself: we copy it too.

3. Asset attribution built in

Most CVE feeds give you a flat list. EchelonGraph tells you which of your assets is affected. Our three-tier scanner stack (cloud-native APIs, on-prem network crawl, in-cluster eBPF agent) maps your infrastructure into a per-tenant graph; the matcher checks new CVEs against the assets and software inventory in it and, on a match, emits a per-tenant alert and surfaces it on the Attack Graph.

4. A published EG Score, and EG Risk to rank by exploitation

NVD shows CVSS only. The EG Score is a 0–10 severity with a confidence rating, set by a published rule cascade in which the first rule that applies decides: a CISA KEV listing puts it at 9.0 or above, an EPSS above 0.30 lifts the CVSS base toward 9.0, and otherwise it takes the CVSS from GitHub's advisory or the NVD/CNA record. It does not lower a score for lack of exploitation, so an unexploited 9.8 stays 9.8. Ranking by exploitation pressure is the job of EG Risk, a separate 0–100 priority — 45% severity, 40% exploitation, 15% automatability — that separates equal-severity CVEs.

Authoritative sources

The pipeline architecture above is based on public documentation from each upstream provider. Verify the claims directly:

CVE Project — cvelistV5 GitHub repository — the canonical source for CNA-submitted records that EchelonGraph polls every 5 minutes.
NIST NVD — REST API v2.0 — the analyst-enriched feed with validated CPE and CVSS.
CISA Known Exploited Vulnerabilities (KEV) catalog — exploit-in-the-wild flag, checked every 5 minutes.
FIRST EPSS — Exploit Prediction Scoring System — daily exploit-probability scores 0–1.
GitHub Security Advisories (GHSA) — ecosystem-tagged advisories for npm, PyPI, Go, Maven, RubyGems.
Google OSV (Open Source Vulnerabilities) — multi-ecosystem coverage with affected-version ranges.
CVE Program — CNA Rules & Documentation — how CVE Numbering Authorities assign and publish records.

See the data behind the claims

Every CVE in our database has its own detail page showing what each source says about it — NVD, the MITRE CNA record, GHSA, the KEV flag, EPSS, and vendor advisory links where a vendor has published one.

Browse the CVE catalogue →The weekly measurement and its raw rows Read the scoring methodology Vendor advisory feed