AI for Enterprise Security
Blast Radius Tells You Which Vulnerability to Fix First.
Crogl computes a vulnerability's blast radius using live threat intelligence: what's exploited, what it can reach, what's already exposed, and whether to patch now or capture forensics first.
Crogl handles the investigation. The analyst makes the call.
New to this? Read the blog.
Top priorityscore 91.4
CVE-2025-68686 (anchor rank #1)
Largest blast radius of the four (5 touched hosts, 2 dependent services) despite having the most runway left on its BOD due date. Radius outweighs the clock.
Notable rippleCVE-2025-68686
Patching VPNGW01 risks breaking the CFO's nightly finance-close report.
VPNGW01 → erp-finance-nightly-sync → svc-finance-nightly-report: an uncoordinated patch window on the VPN gateway can silently break the finance-close pipeline Finance and the CFO depend on every morning, not only remote access.
Click a CVE to trace its blast radius →
CISA BOD Three-Day Clock
Every day looks like Patch Tuesday now.
CISA's Binding Operational Directive 26-04 puts known-exploited vulnerabilities on a three-day remediation clock, and requires documented forensic justification when an externally facing asset can't be patched in time. One Class B network pair runs that cycle at roughly 80,000 machines. Project Glasswing's first discovery run alone surfaced more than 10,000 vulnerabilities, a preview of how fast the queue fills once vulnerability research runs at machine scale.
Blast radius decides which of those machines get fast action and which get care. Critical services and core infrastructure sit at the top of the pyramid, then business applications, executive workstations, general endpoints, and kiosks at the base. The physics holds regardless of team size: the higher up the stack, the more a wrong call costs. That cost lands in an outage thousands of people depend on, or in forensic evidence a reboot destroys for good.
This is vulnerability management with the patch-or-preserve decision built in, not patch management bolted on after the fact.
3 Days
CISA's Binding Operational Directive 26-04 remediation clock for known-exploited vulnerabilities on externally facing assets
80,000
Machines one Class B network pair runs the patch-forensics-validate cycle against, every three days
10,000+
Vulnerabilities surfaced by Project Glasswing's first discovery run, the scale the three-day clock now has to absorb
The Crogl Approach
Blast radius computed. Patch or preserve evidence, in the right order.
Confirmed Against the KEV Catalog
Crogl skills pull confirmed exploitation status and the remediation due date live from CISA's own KEV feed.
Blast Radius Walked Across the Fleet
Every asset carrying the CVE is located and tiered by criticality: critical services and core infrastructure first, then business applications, executive workstations, general endpoints, and kiosks. Crogl walks reachability from there toward anything that matters. The skills are extensible, so you can add your own criticality tiers and reachability paths.
Patch or Preserve, in the Right Order
Anything exploited, or reachable to something critical, gets flagged for evidence capture before the reboot that would destroy it. Everything else clears fast through normal patching. The pyramid tells you where your people's time belongs.
Prove a negative
"Nothing fired" is not an answer.
A new KEV entry lands and leadership asks if you're exposed. The usual move is to search the SIEM, find nothing, and report clean. That report says what was found. It is silent on the segment nobody scanned. Crogl grades every asset and segment covered, partial, blind, or unknown before it lets an investigation close, so a clean result shows exactly what backs it.
4
Coverage grades on every asset: covered, partial, blind, unknown
0
Blind segments a close is allowed to skip
1
Report that separates "vulnerable on paper" from "confirmed exploited"
See It In Action
One advisory. Your whole environment. Watch it happen.
Validated with live data
Built and run against CVEs live on CISA's KEV catalog.
In the screenshot example, Crogl pulled confirmed KEV status straight from CISA's feed, tiered every fleet asset carrying either CVE, and walked reachability toward SharePoint and AD FS.
What Crogl Delivers
Continuously Confirmed Against CISA's KEV Feed
Exploitation status and BOD due dates are pulled live. When a CVE's status changes, Crogl's answer changes with it.
Reachability Walked to What Actually Matters
A CVSS score doesn't know your network. Crogl walks the path from a vulnerable host to whatever it can reach, including AD FS, a finance pipeline, or a backup relay. It prioritizes by what is at stake rather than a generic severity number. Patches roll out in the order that matters.
Honest About What It Can't See
A segment with no telemetry is graded blind, not silently marked clear. Crogl will tell you if a path is contained or if it is dark, with a documented audit trail your compliance team can point to.
Forensics Before the Reboot
Memory capture happens before the patch on anything exploited or on a path to something critical. Evidence a reboot destroys doesn't come back, the order of operations follows how evidence decays.
Answers the Board's Question With Evidence
"Are we exposed?" gets a report that names every checked asset, every blind segment, and every business process the vulnerable host supports.
Computes Blast Radius Across Your Stack
30+ out of the box. With minutes to add new ones. Connectors support federated search. No schema normalization. No recoding. If your data is there, Crogl can query it.
“Know what's exploited. Know what it can reach. Know before you patch.”
Frequently asked questions
Does Crogl need a vulnerability scanner?
No. Crogl works from the telemetry and asset data you already have, and pulls confirmed exploitation status and remediation due dates live from CISA's KEV feed. It locates every asset carrying the CVE, tiers each one by criticality, and walks reachability toward what matters. Every asset and segment is graded covered, partial, blind, or unknown, so a clean result shows exactly what backs it.
How does Crogl support BOD 26-04?
BOD 26-04 gives federal civilian agencies three days to fix a publicly exposed KEV vulnerability that attackers can automate to take total control. It also requires a forensic triage of that asset to assess whether it is already compromised. Crogl runs that assessment, flags exploited or critical-path assets for evidence capture before the patch reboot, and documents the result alongside your existing patching workflow.
See Your Own Blast Radius
What's the blast radius of the CVE sitting in your queue right now?
We'll show you exactly how Crogl computes blast radius. Point it at any CVE you're already tracking.
Deployed in air-gapped federal environments, critical infrastructure, and Fortune 500 financial services institutions.