Do you scan our code or our images?

No, and a run refuses to fabricate a scan. Point your own scanner at the artifact and export the findings — a Dependency-Track CycloneDX and VEX export, a Finding export, a Trivy SBOM result — and the run starts from there. An SBOM on its own is not enough: resolving components to CVEs is the scanner's job, and the run will say so rather than guess.

Which plan do I need to run one?

Premium for both, against a finding set you paste in. Team adds document grounding and unwatermarked HTML, PDF and DOCX exports. The pricing page carries the run allowances.

Do we get a VEX document back?

When your findings carry resolvable SBOM references, yes: the per-finding fragments merge into one CycloneDX VEX for the Dependency-Track "Apply VEX" path. When they do not, the run emits no VEX and records the reason, including which findings were excluded and why. Dependency-Track matches on the bom-ref from your own BOM, so a VEX built on references it cannot resolve would silently annotate nothing.

What is a deferral dossier for?

For the findings you are not fixing yet, and for the file you want when someone asks why. Each deferral records the contextual score, the compensating controls you credited, your own rationale verbatim, and regulatory anchors fetched from the live corpus. It also computes which deferrals trip a reporting duty — the CRA Article 14 duty applies from 11 September 2026. It records and evidences a position; it issues no conformity determination.

How is the investment plan ranked?

By marginal risk reduction, greedily: the simulation picks the control that moves the most across the remaining findings, re-scores, and repeats until nothing further helps. It stops on its own rather than filling a quota, and reports the findings no candidate control reaches as an immovable floor — which is usually the number worth taking to a budget conversation.

Workflow · Vulnerability decisions

Vulnerability assessment & deferral

A decision layer over a scan you already ran: findings rescored against your context, a ranked investment plan, and a deferral you can defend.

Ansvar is a gateway for the AI assistant your team already uses — Claude, Microsoft Copilot, any MCP client. Connect it and your agent runs the workflow; the server enforces the stages and fetches every citation.

Compare plans

KEV · EPSSrescored against exposure and the controls you hold, not the base score

Immovable floorthe plan names what no investment moves instead of padding itself

CRA Article 14reporting flags computed, ahead of the 11 September 2026 duty

Ansvar consumes a scan; it does not run one. Feed a run the finding set you already have — a Dependency-Track export, a Trivy result, your own list — and it rescores each finding through the effective-risk engine with KEV, EPSS and the controls you actually hold, then runs a greedy-set simulation to rank what to buy first. The plan states its own limit: findings that no control moves sit on an immovable floor instead of padding the ranking. The deferral dossier is the other half, for findings you are not fixing yet — it anchors each deferral to the regimes that bear on it and computes the reporting flags the decision triggers.

the family

Two decisions, one evidence trail

Vulnerability Assessment & Control-Investment Plan

Rescore a finding set against your context, then rank what to fix first.

Vulnerability Deferral Dossier & Control-Investment Plan

Evidence a decision not to fix yet, with the regulatory anchors and reporting flags it triggers. Adds a regulatory-anchoring stage to the spine below.

Where findings carry SBOM references, the run merges the per-finding fragments into one CycloneDX VEX you can apply in Dependency-Track. Where they do not, no VEX is emitted and the report says why — a VEX that cannot re-match is worse than none.

how a run works

Five stages the server enforces

1
Finding-set intake
your scanner's export, with the asset context and the controls you hold, confirmed by you before scoring starts
2
Document collection
optional; on Team and above the run grounds itself in your own attestations
3
Contextual scoring
each finding rescored through the engine verbatim, with a VEX fragment where the finding carries a bom-ref
4
Control-investment planning
a greedy-set simulation ranks the candidates and stops when nothing further reduces risk
5
Report
the rescored set, the plan and its floor — structured for your agent, rendered for your auditor

ask your agent

Paste one of these to start

Using Ansvar, rescore this Dependency-Track export against our asset context and give me a ranked control-investment plan.

Using Ansvar, assemble a deferral dossier for the findings we are not fixing this quarter, with the reporting flags each deferral triggers.

install the skill

A prompt starts one run. The skill is the same guidance installed once — the run loop, the evidence and citation rules, and the starters — so your agent works this way in every conversation, not only the ones you remember to paste into. Install it as a skill in Claude or Claude Code, or paste the same file into Microsoft Copilot or a custom GPT's instructions.

Vulnerability Decisions · version 1.0.4 · SKILL.md · ZIP · how to install it

The Vulnerability decisions family runs on Premium and above — run allowances and what each tier adds live on the pricing page.

Questions buyers ask first

Do you scan our code or our images?: No, and a run refuses to fabricate a scan. Point your own scanner at the artifact and export the findings — a Dependency-Track CycloneDX and VEX export, a Finding export, a Trivy SBOM result — and the run starts from there. An SBOM on its own is not enough: resolving components to CVEs is the scanner's job, and the run will say so rather than guess.
Which plan do I need to run one?: Premium for both, against a finding set you paste in. Team adds document grounding and unwatermarked HTML, PDF and DOCX exports. The pricing page carries the run allowances.
Do we get a VEX document back?: When your findings carry resolvable SBOM references, yes: the per-finding fragments merge into one CycloneDX VEX for the Dependency-Track "Apply VEX" path. When they do not, the run emits no VEX and records the reason, including which findings were excluded and why. Dependency-Track matches on the bom-ref from your own BOM, so a VEX built on references it cannot resolve would silently annotate nothing.
What is a deferral dossier for?: For the findings you are not fixing yet, and for the file you want when someone asks why. Each deferral records the contextual score, the compensating controls you credited, your own rationale verbatim, and regulatory anchors fetched from the live corpus. It also computes which deferrals trip a reporting duty — the CRA Article 14 duty applies from 11 September 2026. It records and evidences a position; it issues no conformity determination.
How is the investment plan ranked?: By marginal risk reduction, greedily: the simulation picks the control that moves the most across the remaining findings, re-scores, and repeats until nothing further helps. It stops on its own rather than filling a quota, and reports the findings no candidate control reaches as an immovable floor — which is usually the number worth taking to a budget conversation.

as a service

Prefer we run it?

Every workflow here is also an expert-run service: we run it against your systems, review the output as practitioners, and hand over the finished deliverable. See the services page for how engagements work, or contact us to scope one.

Run it against your own systems

Connect the AI client you already use and ask your first cited question — Free, Solo, Premium and Team are self-serve.

Setup guide