Book a demo
Academic origins · 2023–2025

Built on a master’s thesis.
Not a weekend hackathon.

The detection brain (four signals in the thesis, six in production today) and the XYZ risk score weren’t dreamed up in a sprint planning. The methodology was developed and formally defended as a master’s thesis at the Cork Institute of Technology (now Munster Technological University), then refined into the production engine you see today.

  1. 01 Defended at academic committee Formal methodology review at Cork Institute of Technology (now Munster Technological University), 2023–2025. Not retrofitted to a marketing site.
  2. 02 Tuned on real corpora Over a million vulnerability records, 14,000 OSV-MAL records and 72,000 npm packages with behavioral baselines, all routed through one scoring engine.
  3. 03 Validated against history Replays event-stream, ua-parser-js, colors, faker and node-ipc as control cases before any production install touches a developer machine.
[ Methodology paper available on request ] →
The central idea

Phantom critical vulnerabilities,
in both directions.

The literature the thesis reviews finds that about 73 percent of vulnerabilities rated CVSS 8.0 or higher show little evidence of real-world exploitation. The thesis names that gap and defines the class both ways: the loud ones that are not dangerous, and the quiet ones that are.

// type 1 · false alarms

High score, no teeth.

A vulnerability that CVSS calls critical but that nothing in the real world backs up. It is deprioritised so the team stops spending on it.

  • CVSS 8.0 or higher
  • XYZ score below 6.0
  • EPSS below 0.1
  • No public exploit, no exploitation in the wild
9.0 to 5.5worked example, CVSS to XYZ
// type 2 · hidden threats

Low score, real danger.

A vulnerability CVSS rates medium that sits in an attack chain, in a package everything depends on, on a network-exposed path. It is escalated.

  • CVSS below 7.0
  • XYZ score 7.0 or higher
  • Member of a known attack chain
  • High dependency centrality and network exposure
6.5 to 8.2worked example, CVSS to XYZ
// fig. 01 · what each score takes into account
Scored 0 to 2 from the framework comparison in chapter 3: not considered, partial, built in.
Dependency context Attack chains Exploit evidence Data sources AI assessment PCV detection
CVSSEPSSXYZ score
// fig. 02 · same vulnerability, different verdict
The four representative cases from chapter 5. The score moves down for phantom criticals and up for hidden threats.
0 2 4 6 8 10 High CVSS, no exploit Type 1 PCV · EPSS 0.05 9.0 5.5 Medium CVSS, in attack chain Type 2 PCV · EPSS 0.15 6.5 8.2 High CVSS, active exploits genuine critical · EPSS 0.85 8.5 9.1 Low CVSS, high centrality supply-chain risk · EPSS 0.10 4.0 6.8
CVSSXYZ score
What was measured

The numbers in the thesis,
as of December 2025.

The XYZ score weighs base risk at 40 percent, exploitation history at 30, environmental context at 20 and an AI assessment at 10. It was evaluated on a database built for the thesis and against pip-audit on the same packages.

// database scale, measured
SourceRecords
CVE records717,146
OSV records299,257
Exploit records, ExploitDB46,113
GitHub Security Advisories21,430
Malicious packages4,614
Unique records1,088,564
104,000+ packages across npm, PyPI, Maven and NuGet. Today the production database holds 840K+ vulnerabilities and 240K+ malicious packages.
// coverage vs pip-audit, same five packages aiohttp 1 24 requests 0 34 urllib3 2 27 certifi 0 6 cryptography 0 24
pip-auditXYZ

Total, pip-audit → XYZ3 → 115

38 times the coverage, at a cost: about 47 seconds per package against pip-audit's 20 seconds for the whole 217-package project. The thesis calls that trade-off out rather than hiding it.
// attack chains, individual CVSS to combined 0 2 4 6 8 10 ProxyShell 6.5 · 7.2 · 6.3 alone 9.8 HAFNIUM 7.3 · 7.8 · 6.5 · 7.8 alone 9.9
Individual CVE, CVSSCombined chain
Three medium-rated bugs that together are a critical remote code execution. CVSS scores each one alone; the chain detector scores what an attacker actually does.
Structure

Six chapters, one argument.

  1. 01IntroductionFalse-positive fatigue, the cost of data fragmentation, and why a score that ignores exploitation cannot prioritise.
  2. 02Literature reviewCVSS and EPSS, the vulnerability databases and their gaps, supply-chain attacks, exploitation prediction, AI in vulnerability assessment, and attack-chain analysis of HAFNIUM, ProxyShell and Log4Shell.
  3. 03DesignEight system objectives, the cross-source integration layer, the dependency analysis framework, the XYZ score, the AI committee, attack-chain detection and the PCV classifier.
  4. 04ImplementationPostgreSQL schema, the local CLI agent, the scoring engine, the daily update pipeline and the API.
  5. 05EvaluationPerformance testing, comparative analysis against pip-audit, and accuracy validation on ProxyShell and HAFNIUM.
  6. 06Conclusions and future workWhich objectives were met, what was not measured, and the roadmap that became the product.
From the thesis to production

The thesis scored known vulnerabilities.
The product extends it to day-zero malware.

Everything below started as a chapter. The one thing the thesis did not attempt, catching a malicious package that has no CVE at the moment of install, is what the same scorer does today at the proxy.

Cross-source database, 1,088,564 records840K+ vulnerabilities, 240K+ malicious packages, 11M+ dependency edges, refreshed continuously
XYZ score, 40 / 30 / 20 / 10 weightingSix parallel detection signals fused by a cross-signal scorer into allow, alert, quarantine or block
Local CLI agent, xyz scanxyz Scanner (xyz) on PyPI, the install-time proxy, the VS Code extension and CyberXYZ Gate
Attack-chain detection, ProxyShell and HAFNIUMCampaign tracking mapped to MITRE ATT&CK, and wave correlation across registries
Future work: AI committee evaluationAI-written alert review and commit-level code reading on every pull request

Presented as Beyond CVSS: Detecting Phantom Critical Vulnerabilities in APT Attack Paths at AtlSecCon 2026, Halifax.

Read the methodology Book a demo
// book a demo

Watch it block a real attack. Then run it on your own installs.

Book 15 minutes. We run real packages through CyberXYZ while you watch, including axios 1.14.1, a hijacked release that dropped remote-control malware in March 2026, and show you exactly what your team would see. Then we connect one laptop or one pipeline for a 30-day proof of value.

What happens next

  1. 01A 15-minute callReal packages, real verdicts, and your questions.
  2. 02Connect one laptop or one pipelineOne setup command, or one line in CI. Under an hour.
  3. 03A 30-day proof of value on your own installsEvery signal, no card.

Not ready for a call?

Check any package, free, and see the verdict we would give it.

npm

Try faker@6.6.6ua-parser-js@0.7.29express@4.21.2

Thanks! We'll be in touch.

Check your inbox. We'll reach out within 24 hours.

Where should we send the invite?

  • 15 minutes
  • Video call
  • Times in your time zone

We reply within 24 hours to set a time.

We only use these details to arrange the call. Privacy policy