Controls

Search controls

Catalogue summary

Risk-prioritised gaps — top 25 CVEs

The 25 highest-risk CVEs we've mapped to controls, each paired with the single strongest mitigating NIST 800-53 r5 control. A row is a gap when that control has no concrete, checkable implementation in our controls catalogue — i.e. no specific cloud or hardening control (AWS Trusted Advisor, Azure Secure Score, DISA STIG, and so on) that we can point to as enforcing it and that we could automatically verify. In plain terms, a gap is a high-risk CVE whose best-fit mitigation we have no automated way to confirm is actually in place. Currently 21 of 25 are gaps. Many of the top CVEs share the same maximum Risk, so rows tie-break on peak EPSS (exploitation likelihood); this only orders equally-risky CVEs and never lowers a Risk score, so a freshly-published critical with low EPSS keeps its rank.

KEV coverage — controls that block actively-exploited threatsAI-assisted

For each of CISA's 1,674 Known Exploited Vulnerabilities, we pick the single strongest mitigating NIST 800-53 r5 control (per-CVE LLM annotation when available, falling back to the CWE→control mapping). The table below shows the top 20 controls ranked by how many KEV CVEs they would mitigate. 1,316 of 1,674 KEV CVEs (79%) are attributed to a control.

Coverage gaps — NIST 800-53 r5 by family

For each NIST 800-53 family: how many top-level controls exist, how many have at least one cloud-config implementation in our catalogue, and how many distinct implementations target that family. Bigger numbers and longer green bars are better. Currently 33 of 324 controls (10%) have implementations across 210 impl-spec mentions; the rest are gaps in the impl catalogue, not the controls themselves.

Encryption at rest — required cloud configurations

The implementations below all satisfy NIST 800-53 r5 SC-28 (Protection of Information at Rest). Pick the platforms relevant to your stack; each row is a specific check you need to keep green.