Built by someone who had to parse NVD under pressure.
Attestd turns public vulnerability data into deterministic signals automated systems can act on: CVE risk, supply chain integrity, and package name integrity.
Robert Marshall
Systems administrator. Builder of Attestd.
Toronto, Ontario, Canada
The 2 a.m. version of this problem.
A critical advisory lands during an incident. The CVE description is prose. The affected ranges are CPE strings that do not match your package manager's version format. CISA KEV is a separate lookup. The question is simple: is the version we are running exploitable right now? Getting the answer meant reading, cross-referencing, and hoping nothing was missed, under pressure, at 2 a.m.
I did that work for years as a systems administrator. The data was always public. It was never machine-readable. Every team I saw either built a fragile internal parser, paid for a scanner that answered a different question, or did it by hand.
Attestd is that missing layer, built as a product. Marshall Digital Solutions Ltd., Toronto. One person, full stack, no outsourced data pipeline. Every design decision below exists because I have watched the ambiguous version of it fail.
What ambiguous security data breaks in production.
determinism
Same product@version returns the same risk_state within an ingestion snapshot. Automated systems can branch without flapping.
worst-case aggregation
When multiple CVE ranges match, severity and risk factors resolve to the worst case. Ambiguity does not get rounded down.
honest unsupported
supported: false is not a safety clearance. Check typosquat first. Then decide: block, warn, or skip with justification.
Full technical walkthrough: Why Attestd.