ENTERPRISE SECURITY MODELS · A NEW CATEGORY
Predict attacks
with the only security models
custom-built for each enterprise.
Empirical builds a security model for your organization alone. You get a calibrated 30-day probability of where attackers will break in, so you can get there first.
Our models
Close
Foundation
A global model that combines real-time internet exploitation telemetry with EPSS and monitors over 19,000+ exploited CVEs to help you prioritize and remediate threats.
Radiant
A custom built local model that uses everything in Foundation plus your own local assets, configurations, and internal telemetry to predict threats specific to your organization.
Foundation+Your environment=Radiant
“This is light years ahead of other tools.”
Security Lead · Fortune 100 Financial Services
CVEs covered
400,000
With active exploitation
19,000
Models refreshed
Hourly
The problem
Vulnerabilities are accelerating.
Exploits aren’t.
Mythos and AI have pushed vulnerabilities beyond where humans can prioritize and patch with legacy tools. Your team has to search an expanding attack surface for a small, but growing, number of real attacks.
Cumulative CVEs published
Exploited CVEs
The gap
Thousands of new findings to search. Only a handful are real attacks.
Exploits · barely moving
Real-world exploitation stays almost flat while the noise keeps climbing.
Quarterly, Jan 2017 – Jul 2026 · cumulative CVEs vs exploited CVEs
Source: Empirical
The Empirical solution
Not a frontier model.
Your model.
Frontier models are language models. Ours are built on prediction and probability, built by hand for each customer to reflect your unique assets and attributes, then trained and updated. You know what to fix, and what to delay.
Your model · layered on your environment
Static severity scores & generic feeds
One score for every company
Thousands of findings marked critical
Updated when the advisory changes
Can’t say what’s safe to delay
Asks you to trust the score
An Empirical model
Built by hand for your environment
Calibrated 30-day probability
Refreshed every hour
Shows what’s safe to delay
Benchmarks its own accuracy
How it works
CloseOur platform supports Empirical’s Radiant and Foundation models. The Foundation model, trained on ~2 million exploitation events, captures attacker behavior across the internet. Radiant models, trained on your environment’s telemetry, capture more targeted attacks. The two models work together to surface the vulnerabilities most likely to be exploited in your infrastructure.
External data
Local data
Platform
UI
API
AgentThe capacity view
CloseIf your team can only work X% of the backlog, how much of the real exploitation activity does that cover? The Coverage vs Effort curve answers exactly that, and shows the tradeoff behind any prioritization strategy.
7% → 90%
Working just the top 7% of Empirical Foundation scores covers 90% of observed exploited vulnerabilities.
Effort
The share of all vulnerabilities you prioritize.
Coverage
The share of exploited vulnerabilities inside that set.
Platform
Patch less. Prove more.
Exposure management beyond CVEs
Your own telemetry (intrusion detections, firewall and WAF events, endpoint alerts and incident history) shapes the model.
Exploitation telemetry from 19,000+ CVEs
The largest real-world exploitation dataset in the industry: 5× larger than any single intelligence vendor.
Intel updated every hour
Scores refresh hourly so you move at the speed of attackers, not static severity labels.
Risk reduction you can communicate
Patch less, fix what’s truly dangerous, and show the improvement to peers and the board.
Remediation made easy
We find where attackers will break in, then generate and deliver the patch. Track risk as it falls.
No black box
A rolling 30-day retrospective shows how well we reduced your risk. Proof, not “trust us.”
Our models
Start global. Go local.
Foundation
A global model that combines real-time Internet exploitation telemetry and monitors over 19,000 CVEs to help you prioritize and remediate threats.
Radiant
Everything in Foundation, plus your own assets, configurations and internal telemetry: a model that predicts threats specific to your organization.
Trained on 19,000+ exploited CVEs
CloseOur models are trained on over 19,000 known exploited CVEs. Here is what that buys you against CVSS.
It would take more than 10× the people and resources to prioritize potential threats using CVSS than Empirical.
CVSS 9+ (Critical)
- Threshold: 0.9
- Effort: 14.4%
Empirical Radiant (same effort)Better coverage and efficiency
- Threshold: 0.028
- Effort: 14.4%
You will be 6× more efficient at remediating actual threats using Empirical than using CVSS.
CVSS 7+ (High to Critical)
- Threshold: 0.7
- Coverage: 76.8%
Empirical Radiant (same coverage)Less effort, more efficiency
- Threshold: 0.968
- Coverage: 76.9%
Local model results may vary depending on your security dataset.
The Empirical agent
Ask how you’re doing. See the proof.
Our agent runs on your models. Ask in plain language and it answers with your own data: what you’ve fixed, how much risk it removed, and what to do next.
- 01Opens anywhere with ⌘ / ⊞ + J
- 02Answers from your Radiant model, not a generic feed
- 03Builds live reports you can share with the board
How am I doing at reducing risk?
Just now
Remediation Dashboard
Snapshot · today
Windows · Server 2019 → build 7.62.0
83 exposures · 96 assets Top fix: −35% risk