Early Warning for Security Exposure Management

Early Warning for Security Exposure Management, powered by Armis, enriches the Central Vulnerability Database (CVDB) in Unified Security Exposure Management (USEM) with vulnerability intelligence of imminent exploit. This enables your security team to prioritize and patch vulnerabilities before threat actors weaponize them.

Early Warning for Security Exposure Management pulls a curated list of Common Vulnerabilities and Exposures (CVEs) into Unified Security Exposure Management. It enriches vulnerability records with vulnerability intelligence validated through honeypot activity, Open Source Intelligence Framework (OSINT), and operational vulnerability research. This enrichment helps security teams to prioritize vulnerabilities and coordinate response through established vulnerability management workflows.

When Early Warning matters

Early Warning shifts vulnerability management from reactive crisis to proactive defense, providing strategic advantage by detecting which vulnerabilities threat actors are actively trying to exploit.

Without early warning: When a vulnerability is published, threat actors can exploit it within hours. Your team patches reactively under pressure, often with inadequate testing and high risk of failure.

With early warning: Your team gains early visibility into active exploitation signals such as honeypot activity, OSINT, and operational research often before broader awareness or inclusion in feeds like CISA KEV. This additional lead time helps teams test patches, coordinate across regions, validate changes, and deploy during planned maintenance windows instead of responding in crisis mode.

When Early Warning Is critical: Early Warning is most valuable for organizations where patching takes time or downtime is costly:

• Legacy systems and industrial controls (ICS/SCADA): Systems that can't be rebooted quickly or easily patched. Early warning provides time for safe, planned updates instead of emergency changes that risk production downtime.
• Healthcare systems: Patient care equipment and Electronic Health Record (EHR) systems require validation before patching. Early warning allows time to coordinate updates during low-patient-census windows without disrupting care.
• Manufacturing and operations: Downtime costs millions per hour. Early warning allows time to plan patches during scheduled maintenance windows instead of emergency shutdowns.
• Financial services and payment systems: Patch windows are scheduled in advance. Early warning ensures patches are tested and ready to deploy when the window arrives, instead of scrambling on the deployment day.
• Multi-region enterprises: Complex environments with factories, offices, or data centers across regions take time to coordinate. Early warning provides the runway to test and deploy across all sites safely.
• Regulated industries: Compliance auditors want to see proactive vulnerability management, not reactive patch-and-pray. Early warning demonstrates a prevention-first security posture.
• High-value targets: Organizations subject to nation-state or sophisticated cyber attacks. Early warning closes the window where you're undefended before threat actors act.

Detecting exploitation signals from honeypots, OSINT, and operational research before broader industry recognition or CISA KEV inclusion enables proactive patching and reduces the need for high-risk emergency updates.

How it works

Early Warning for Security Exposure Management performs the following operations:

1. Detection: Identifies a vulnerability that threat actors are planning to exploit.
2. Integration: The early warning signal is ingested into USEM and automatically elevates the priority of that CVE in your vulnerability inventory.
3. Prioritization: Your security team sees the early warning flag and prioritizes patching this vulnerability ahead of others, even if CVSS scores don't reflect the real-world threat.
4. Response: Your team coordinates patch deployment during a planned maintenance window after receiving an Early Warning signal.

Your team spends time on vulnerabilities that threat actors are actually targeting, not just the ones with the highest severity scores.

How Early Warning integrates with USEM

When you integrate Early Warning for Security Exposure Management with Unified Security Exposure Management (USEM), early warning signals automatically feed into your vulnerability prioritization workflow:

1. Early Warning detects that threat actors are planning to exploit CVE-XXXX.
2. USEM receives early warning signal and automatically elevates the priority of that CVE in your inventory.
3. Your team prioritizes patching this vulnerability ahead of others, even if severity scores don't reflect the real-world threat.
4. You patch vulnerabilities proactively as soon as an Early Warning signal is received.

This means your security team spends time on the vulnerabilities that actually matter- the ones threat actors are targeting and not just the ones with the highest Common Vulnerability Scoring System (CVSS) scores.

The integration appears in the Security Exposure Management workspace alongside other enrichment integrations such as the CISA Known Exploited Vulnerabilities integration. You can monitor integration run history, ingestion health, and processing health from the integration overview page.

Key benefits

Early Warning for Security Exposure Management provides the following benefits:

• Earlier risk prioritization: Early warning flags surface alongside your vulnerability risk scores, so remediation teams focus on the threats that matter most. Instead of patching by CVSS score alone, you patch based on real-world threat actor behavior.
• Faster remediation without extra setup: Early warning CVEs trigger existing Vulnerability Change Management workflows automatically, with no custom integration required.
• Faster identification of at-risk assets: Filter findings by early warning status to surface which assets carry elevated risk.
• Built-in asset correlation: Early warning signals roll up from CVE records to third-party entries automatically, extending risk visibility to the assets already tracked in your Vulnerability Response data with no additional CMDB mapping required.

Data available in USEM

When you integrate Early Warning for Security Exposure Management, two new columns appear in your vulnerability records:

• Armis Early Warning: A flag indicating that threat actors are planning to exploit this CVE.
• Armis Early Warning CVD Attributes: Detailed vulnerability intelligence including:
  • CVE ID and affected product
  • Intelligence date (when Armis detected the threat actor activity)
  • Admiralty score (confidence rating of the vulnerability intelligence)
  • Honeypot detection date
  • Research date

You can use these columns to filter, sort, and prioritize your vulnerability remediation workflow.

The integration appears in the Security Exposure Management workspace alongside other enrichment integrations, such as CISA Known Exploited Vulnerabilities. From the integration overview page, you can monitor run history, ingestion health, and processing status. For more information, see Security Exposure Management Workspace List view

Admiralty score

Each CVE in the Armis feed includes an Admiralty score - a confidence rating based on the NATO Admiralty grading system. Scores range from A1–A6, B1–B6, C1–C6, D1–D6, E1–E6, and F1–F6, where A1 represents information from a completely reliable source that has been independently corroborated. A lower confidence rating does not prevent a CVE from being identified as an early warning signal. CVEs with lower Admiralty scores may still be surfaced when other factors indicate potential relevance or risk.

You can use the Admiralty score as an additional condition in a risk rule to refine prioritization. For example, you can configure the rule to apply a weight only to CVEs whose admiralty score meets a defined reliability threshold.

Customizing risk rules

The early warning flag and Admiralty score are available as criteria in your risk rules, allowing you to customize how early warnings influence your vulnerability scores.

In the default risk calculator, you can:

• Adjust the weight applied to early warning CVEs
• Add Admiralty score as an additional condition for refinement
• Create custom rules that combine early warning signals with other risk criteria

In the default risk calculator, you can adjust the weight or add the admiralty score as an additional condition to refine prioritization.

Early Warning extends risk coverage to CVEs which may not yet be identified by intelligence sources such as CISA KEV or EPSS.

Key components

Early Warning for Security Exposure Management consists of the following components:

Integration plugin

Early Warning for Security Exposure Management (sn_vul_ew): Handles data ingestion via the Vulnerability Integration Framework

CVD attributes table

sn_vul_ew_cvd_attributes: Stores early warning-specific threat signals (admiralty score, honeypot date, intelligence date, research date, CWE)

Flag rollup

Business rules propagate ew_exists flag from NVD entries to third-party entries for consolidated risk assessment

Risk calculator field

vulnerability.ew_exists: Boolean risk criteria available for custom risk rule weighting

Dependencies and prerequisites

The Early Warning for Security Exposure Management integration requires the following:

• Unified Security Exposure Management (Vulnerability Response v30.x)
• Vulnerability Integration Framework plugin
• Access to Armis vulnerability intelligence feed and valid authentication credentials

• Install the required applications for Early Warning for Security Exposure Management
  Install the required applications for Early Warning for Security Exposure Management.
• Set up requirements for Early Warning for Security Exposure Management
  Complete the following setup steps in your Armis Intelligence Center console environment before you configure Early Warning for Security Exposure Management in your ServiceNow AI Platform® instance.
• Configure the Early Warning for Security Exposure Management integration
  Install and configure the Early Warning for Security Exposure Management integration plugin to ingest vulnerability intelligence and enrich your vulnerability database with threat signals.
• Add Early Warning criteria to a risk rule
  Add the Early Warning flag or Admiralty score as a weighted criterion in a risk rule to prioritize vulnerable items based on vulnerability intelligence data.
• Schedule the Early Warning for Security Exposure Management integrations
  You can schedule the integration import times on the records in the Vulnerability Integrations [sn_vul_int_fw_integration] table and launch them on-demand.
• View Early Warning for Security Exposure Management integration health
  Monitor the Early Warning for Security Exposure Management integration by reviewing run history, ingestion performance, and processing health from the Security Exposure Management Administration console.
• Early Warning CVD Attributes field reference
  The Early Warning CVD Attributes table stores vulnerability intelligence signals for vulnerabilities. Each attribute represents a threat indicator ingested from the Early Warning feed.

Related concepts

• Integrations for Central Vulnerability Database
• Security Exposure Management Workspace List view

Related tasks

• Define fields and weights for the risk rule for Unified Security Exposure Management risk calculators