Exploit Hound

The problem

Vulnerability scanners are good at producing findings and bad at deciding. Ranking by CVSS alone sends technicians after issues that don’t matter while real paths to critical systems stay open — and a remote-management tool reporting “patched” isn’t proof that anything changed.

Why existing tools fell short

Vulnerability scanners rank findings by severity score, which produces long lists without telling a technician which fix removes the most real risk — and they generally accept a patch tool’s “success” as proof.

The solution

Exploit Hound builds a customer-scoped exposure graph from discovered assets and findings, then groups work into technician-sized actions ranked by how many modeled attack paths each one removes. After a fix, it re-checks to verify the exposure is actually gone.

Threat Radar adds outside context: vulnerabilities confirmed as exploited in the wild (CISA KEV) and those with the highest predicted likelihood of exploitation (FIRST EPSS).

• “Fix First” — findings grouped into technician actions, ranked by attack paths removed
• Asset discovery: external surface, onsite LAN probe, and endpoint agents
• Remediation verified by re-checking, not by trusting a tool’s “success”
• Threat Radar: known-exploited and most-likely-exploited vulnerabilities
• Multi-tenant MSP console with per-customer exposure graphs

Engineering involved

Drawn from the product’s own public documentation and trust pages. Only components the product publicly documents are listed.

Architecture

Hosted management with local collection: collectors and agents connect outbound over TLS, so no inbound connection to the customer network is required.

Tenant isolation

Every query is scoped to the tenant in the data model rather than only in the interface.

Data & threat intelligence

Correlates the CVE Program, NVD, FIRST EPSS, OSV, Exploit-DB, GitHub advisories, and CISA KEV.

Collection

External surface discovery, an onsite LAN probe, NetFlow, deception/honeypots, and an OS client for Linux, Windows, and macOS (macOS in beta) written in Go.

Authentication

Time-based one-time codes for accounts with two-factor enabled.

AI integration

An optional AI security analyst (Anthropic) that cannot trigger scanning or any state change.

Integrations

Identity, cloud, PSA, and RMM integrations (Entra ID, Google Workspace, AWS/Azure/Google Cloud, HaloPSA, ConnectWise, Autotask, NinjaOne, Datto, and more) are documented as in beta.

What makes it interesting

Prioritization is modeled, not scored. Ranking fixes by attack paths removed — instead of by severity number — turns a list of thousands into a short, defensible to-do list, and the “verified by re-checking” step closes the loop that most tooling leaves open.

Outcome

Not measured The core exposure workflow is generally available and the platform is in its founding beta program. No usage, revenue, or performance figures have been published, so none are claimed here.

Current status

Active Beta Working software in a public beta or early-access program — not yet generally available.

Exploit Hound’s core exposure workflow is generally available, and it runs a founding beta partner program. The product publishes which capabilities are generally available, which are in beta (notably identity, cloud, PSA, and RMM integrations), and which are not built. It states that there is no SOC 2 report, ISO 27001 certificate, or independent penetration test.

See it working

See the twelve-screen product tour from the running console (demonstration data) at exploithound.com/product-tour, or the public Threat Radar.