Building an Exploit Intelligence Platform from Scratch
Let's be honest about the state of public exploit intelligence: it's a mess.
The Problem Nobody Talks About
Every security professional has lived this. A critical CVE drops. You need to know: is there a public exploit? Does it actually work? Is it relevant to my environment? Simple questions. You'd think the answers would be easy to find.
They're not.
The NVD gives you metadata - CVSS scores, CWE classifications, affected product lists. Useful, but it won't tell you if someone's already weaponized the vulnerability. For that, you need exploit databases. And this is where things get uncomfortable.
The public exploit archives have a quality problem. Browse through them and you'll find proof-of-concepts that were never tested, scripts that target the wrong version, code that doesn't compile, and - this is the part that really gets us - exploits that are straight-up backdoored. Repositories with hundreds of GitHub stars that contain obfuscated reverse shells buried in "helper" functions. People download these things and run them on their assessment machines. Researchers, pentesters, defenders trying to validate whether they're vulnerable - and the tool they're using to check is itself malicious.
Nobody talks about this enough. The community treats exploit archives like trusted infrastructure, but the reality is that most public exploit code has never been verified by anyone. There's no peer review. No quality gate. You're on your own.
Meanwhile, the data you actually need is scattered across a dozen sources that don't talk to each other. NVD has the CVE. EPSS has the exploitation probability. CISA KEV has the confirmed-in-the-wild list. Metasploit has peer-reviewed modules. ExploitDB has a massive archive. GitHub has thousands of PoCs. None of them give you the complete picture. You want to answer "should I care about this CVE?" and you need six browser tabs and twenty minutes.
We got tired of the tab-switching. So we built EIP.
What EIP Actually Does
The Exploit Intelligence Platform pulls from 16 sources, correlates everything by CVE, and gives you the full picture in one place. The usual suspects are all here - NVD for metadata, CISA KEV for confirmed in-the-wild exploitation, EPSS for 30-day exploitation probability, ExploitDB for the archive (warts and all), Metasploit for the gold standard in peer-reviewed modules, and GitHub for the wild west of PoC repositories. But also VulnCheck KEV with ransomware attribution, InTheWild.io for crowd-sourced exploitation signals, ENISA's EU database, OSV.dev for kernel version ranges, Nuclei for scanner templates, and GHSA for package ecosystem advisories.
Sixteen sources, each on its own ingestion schedule. The pipeline normalizes the data, deduplicates it, correlates everything to CVE IDs, and - this is the part we care about most - ranks exploits by quality.
Public exploit and PoC sources are not interchangeable, but source identity is not a quality ranking. EIP preserves ExploitDB, Metasploit, and repository metadata, source-native dates, associations, and optional attributed analysis without claiming that an artifact works, is verified, is reliable, or is safe. GitHub stars remain source metadata and do not control ordering.
The AI Layer
Ranking by source gets you partway there. But the quality problem runs deeper than provenance.
Where current stored analysis is available, it keeps technical classification and an independent backdoor review as separately attributed model interpretation. It can flag deception indicators such as obfuscation, hidden callbacks, or credential exfiltration, but it never becomes an EIP reliability or safety verdict and never controls whether an artifact remains visible.
Stored analyses have identified both trojan and suspicious PoC material. These aren't abstract risks - they can be repositories associated with real vulnerabilities. The trojan detection post goes deeper, but the durable lesson is simple: never execute acquired public code merely because a catalogue or model result exists.
The Numbers
The corpus changes continuously, so fixed totals in an article age badly. Current vulnerability, PoC, KEV, Nuclei, vendor, author, and lab counts live on the Statistics page. When you query EIP for a CVE, you get the current source-backed projection rather than the snapshot that existed when this article was published.
Why It's Free
This is a non-commercial project. There's no paid tier, no enterprise upsell, no "contact sales for the full data." The API has rate limits to keep things fair, but the data is open.
We built this because we needed it. The tools that existed didn't give us what we wanted - and the ones that came close were either paywalled, poorly maintained, or hadn't been updated since the Obama administration. The security community deserves exploit intelligence that is fast, source-attributed, and doesn't treat basic vulnerability context as a premium feature.
Old-school spirit, modern infrastructure. Built for responsible research and authorized testing. That's it.
What's Next
The AI analysis pipeline keeps expanding. More exploit sources are being integrated. The MCP server already lets AI assistants query the full platform directly - which led to some unexpected results we'll be writing about soon.
This blog is where we'll share what we learn along the way. If you've been frustrated by the same problems we were - the tab-switching, the unverified PoCs, the constant question of "but does this actually work?" - give the platform a look. If you find something broken, tell us. If you build something interesting on top of it, we'd love to hear about it.