Models
Foundation
A global model that combines real-time internet exploitation telemetry with EPSS and monitors over 19,000+ exploited CVEs to help you prioritize and remediate threats.
Radiant
A custom built local model that uses everything in Foundation plus your own local assets, configurations, and internal telemetry to predict threats specific to your organization.
How It Works
Our platform supports Empirical's radiant and foundation models. The foundation model, trained on ~2 million exploitation events, captures attacker behavior across the internet. Radiant models, trained on your environment's telemetry, capture more targeted attacks. The two models work together to surface the vulnerabilities most likely to be exploited in your infrastructure.
External Data
Local Data
Models (Radiant and Foundation)
Platform
UI
API
Agent
External Data
Local Data
Models
Platform
UI
API
Agent
External Data
Empirical monitors exploitation activity across 19,000+ CVEs. We observe exploitation as it happens and changes.
• 19,000+ known exploited vulnerabilities, tracked in near-real time
• Hourly exploitation telemetry per CVE, with years of historical depth
• Millions of malware hashes correlated to specific CVEs
• 1,400+ OSINT sources
• Ground-truth data from the team that built EPSS
Local Data
Empirical ingests scan results, asset metadata, compensating controls, patching velocity, network topology and uses that data to train a model only you can access.
• We ingest your scanned assets and vulnerability findings.
• We evaluate your environmental telemetry and compensating controls.
• Your local model improves with every month of data.
Models
Our models are statistical learning systems that produce measurable predictions with coverage and efficiency that you can verify.
• Radiant Models: trained on your assets, your controls, your environment to determine which findings pose real risk to you.
• Foundation Models: trained on internet-scale exploitation data to forecast attacker behavior.
• Together: higher coverage, higher efficiency, fewer wasted cycles. Recreating these models in-house would require $500K in threat data as well as a team of security researchers and data scientists.
Platform
Empirical is the only exposure management vendor that publishes a false positive rate and measures performance. Our platform trains predictive models on near-real time exploitation telemetry and your enterprise's own data (assets, applications, controls, patching cadence) to produce calibrated probabilities of exploitation that you can measure, test, and defend to your board.
Your data. Your way.
Access our models in multiple ways: via MCP with your agent, using our own agent, via API, or via UI. Your choice.
Effort, Efficiency, and Coverage
CloseAll Published Vulns (CVEs we could prioritize)
Effort
Measures the relative workload as the proportion of vulnerabilities prioritized out of all the possible CVEs:
( True Positives + False Positives ) / Everything
Efficiency
Measures how accurately our strategy focuses on vulnerabilities that have exploitation activity (False Positives are prioritized without any exploitation activity observed):
True Positives / ( True Positives + False Positives )
Coverage
Measures how well our strategy covers the vulnerabilities we prioritized from all vulnerabilities that show exploitation activity (False Negatives are not prioritized and exploitation activity is later observed):
True Positives / ( True Positives + False Negatives )