Book a demo →
Academic origins · 2023–2025

Built on a master’s thesis.
Not a weekend hackathon.

The four-signal detection brain and the XYZ risk score weren’t dreamed up in a sprint planning. The methodology was developed and formally defended as a master’s thesis at the Cork Institute of Technology (now Munster Technological University), then refined into the production engine you see today.

  1. 01 Defended at academic committee Formal methodology review at Cork Institute of Technology (now Munster Technological University), 2023–2025. Not retrofitted to a marketing site.
  2. 02 Tuned on real corpora 1.3M vulnerabilities, 14,000 OSV-MAL records and 72,000 npm packages with behavioral baselines, all routed through one scoring engine.
  3. 03 Validated against history Replays event-stream, ua-parser-js, colors, faker and node-ipc as control cases before any production install touches a developer machine.
[ Methodology paper available on request ] →
The central idea

Phantom critical vulnerabilities,
in both directions.

The literature the thesis reviews finds that about 73 percent of vulnerabilities rated CVSS 8.0 or higher show little evidence of real-world exploitation. The thesis names that gap and defines the class both ways: the loud ones that are not dangerous, and the quiet ones that are.

// type 1 · false alarms

High score, no teeth.

A vulnerability that CVSS calls critical but that nothing in the real world backs up. It is deprioritised so the team stops spending on it.

  • CVSS 8.0 or higher
  • XYZ score below 6.0
  • EPSS below 0.1
  • No public exploit, no exploitation in the wild
9.0 to 5.5worked example, CVSS to XYZ
// type 2 · hidden threats

Low score, real danger.

A vulnerability CVSS rates medium that sits in an attack chain, in a package everything depends on, on a network-exposed path. It is escalated.

  • CVSS below 7.0
  • XYZ score 7.0 or higher
  • Member of a known attack chain
  • High dependency centrality and network exposure
6.5 to 8.2worked example, CVSS to XYZ
// fig. 01 · what each score takes into account
Scored 0 to 2 from the framework comparison in chapter 3: not considered, partial, built in.
Dependency context Attack chains Exploit evidence Data sources AI assessment PCV detection
CVSSEPSSXYZ score
// fig. 02 · same vulnerability, different verdict
The four representative cases from chapter 5. The score moves down for phantom criticals and up for hidden threats.
0 2 4 6 8 10 High CVSS, no exploit Type 1 PCV · EPSS 0.05 9.0 5.5 Medium CVSS, in attack chain Type 2 PCV · EPSS 0.15 6.5 8.2 High CVSS, active exploits genuine critical · EPSS 0.85 8.5 9.1 Low CVSS, high centrality supply-chain risk · EPSS 0.10 4.0 6.8
CVSSXYZ score
What was measured

The numbers in the thesis,
as of December 2025.

The XYZ score weighs base risk at 40 percent, exploitation history at 30, environmental context at 20 and an AI assessment at 10. It was evaluated on a database built for the thesis and against pip-audit on the same packages.

// database scale, measured
CVE records717,146
OSV records299,257
Exploit records, ExploitDB46,113
GitHub Security Advisories21,430
Malicious packages4,614
Unique records1,088,564
104,000+ packages across npm, PyPI, Maven and NuGet. Today the production database holds 1.3M+ vulnerabilities and 207K+ malicious packages.
// coverage vs pip-audit, same five packages aiohttp 1 24 requests 0 34 urllib3 2 27 certifi 0 6 cryptography 0 24
pip-auditXYZ

Total, pip-audit → XYZ3 → 115

38 times the coverage, at a cost: about 47 seconds per package against pip-audit's 20 seconds for the whole 217-package project. The thesis calls that trade-off out rather than hiding it.
// attack chains, individual CVSS to combined 0 2 4 6 8 10 ProxyShell 6.5 · 7.2 · 6.3 alone 9.8 HAFNIUM 7.3 · 7.8 · 6.5 · 7.8 alone 9.9
Individual CVE, CVSSCombined chain
Three medium-rated bugs that together are a critical remote code execution. CVSS scores each one alone; the chain detector scores what an attacker actually does.
Structure

Six chapters, one argument.

  1. 01IntroductionFalse-positive fatigue, the cost of data fragmentation, and why a score that ignores exploitation cannot prioritise.
  2. 02Literature reviewCVSS and EPSS, the vulnerability databases and their gaps, supply-chain attacks, exploitation prediction, AI in vulnerability assessment, and attack-chain analysis of HAFNIUM, ProxyShell and Log4Shell.
  3. 03DesignEight system objectives, the cross-source integration layer, the dependency analysis framework, the XYZ score, the AI committee, attack-chain detection and the PCV classifier.
  4. 04ImplementationPostgreSQL schema, the local CLI agent, the scoring engine, the daily update pipeline and the API.
  5. 05EvaluationPerformance testing, comparative analysis against pip-audit, and accuracy validation on ProxyShell and HAFNIUM.
  6. 06Conclusions and future workWhich objectives were met, what was not measured, and the roadmap that became the product.
From the thesis to production

The thesis scored known vulnerabilities.
The product extends it to day-zero malware.

Everything below started as a chapter. The one thing the thesis did not attempt, catching a malicious package that has no CVE at the moment of install, is what the same scorer does today at the proxy.

Cross-source database, 1,088,564 records1.3M+ vulnerabilities, 207K+ malicious packages, 10M+ dependency edges, refreshed continuously
XYZ score, 40 / 30 / 20 / 10 weightingSix parallel detection signals fused by a cross-signal scorer into allow, alert, quarantine or block
Local CLI agent, xyz scanThe xyz CLI on PyPI, the install-time proxy, the VS Code extension and the CI/CD gate
Attack-chain detection, ProxyShell and HAFNIUMCampaign tracking mapped to MITRE ATT&CK, and wave correlation across registries
Future work: AI committee evaluationAI-written alert review and commit-level code reading on every pull request

Presented as Beyond CVSS: Detecting Phantom Critical Vulnerabilities in APT Attack Paths at AtlSecCon 2026, Halifax.

Read the methodology Book a demo