Open the decision you made, with your reason and the evidence the index held when you recorded it. The next reviewer can inspect the basis of the call, even after the public feeds change.
See a sitrep See a weekly all-clear
Paste what you run, one product per line, and see every CVE that touches it. Each one is where a record starts. Start without an account. Sign in to keep it. Your first 100 records are free. Choose your verdict on a real CVE
A record holds the verdict, rationale, author, recording time, review date and frozen source evidence. Each amendment adds a version to its hash chain.
The example is vciy's own Log4Shell record, made public for inspection. Customer records are private. Sharing names a person who signs in to see that record.
Get the independent export verifierUpgraded log4j-core to 2.17.1 across every service during the December 2021 disclosure window.
Retrospective worked example: the 2021 action was recorded in September 2026. Its frozen evidence is from record creation, not 2021. Customer records are private.
Open a CVE and choose accept, defer, patch by a date, not affected or mitigated. The record starts with that CVE and verdict.
Try it on the Ray CVESign in, write the rationale and set a review date. vciy supplies the evidence it holds and stamps the recording time on its server.
Copy the record's paragraph into your ticket, with its link. Reviewers can follow the decision to the evidence instead of rebuilding the case from a comment.
Open the CVE and choose a historical date to read the facts the index held then. A record created today still carries today's recording time, even when its rationale describes an earlier decision. Historical coverage is limited to the sources and dates held.
Open the CVE and choose a dateEvery plan can watch for material changes: one stack of three products free with an account, three stacks on Practitioner, ten on Advisor and unlimited on Custody. The original record keeps its frozen evidence; a new finding is a reason to review the call.
A new CISA KEV listing, a change to the CISA remediation deadline, a change in public exploitation status, a public proof-of-concept exploit appearing, and exploit probability crossing 10%, 50% or 90% in either direction all count as a move. An exploit-probability change that crosses none of those lines does not. A source republishing a value it already holds is not a change at all.
See how watchlists workAn incident or a near miss is a record too: what happened, who owns it, the products and CVEs involved, and when to check back, with the evidence on its CVE frozen the day it opened. Anyone in your organisation finds it again by searching your records, a year later, in another team. New evidence on its CVE reaches you while it is open, and the check-back date sends one reminder.
Close it with a new version that says what you found. What it said while open stays readable. Keep it to named people when it has to be: then only its author, your organisation's owner and the people you share it with can find it.
When an investigation needs more than the public record, two escalation paths sit right inside it: 1. Automated deep code analysis ($49.99 per run) checks your pasted call stack, manifest or repository reference against the CVE's held ranges and weakness class using our Sovereign AI model and formats the result to freeze into the chain; 2. Send me an expert · contact us routes the CVE, your investigation chain and your notes to our specialist desk.
Start with one CVE that touches what you run. Amendments add versions without using another record.
$0 PractitionerWhen the register outgrows 100, or your team shares it. Three seats, searchable history and three stacks watched.
$20 a month or $200 a yearStart Practitioner AdvisorWhen you record calls for clients. Ten stacks, each with its own register, and dated proof of what you told which client.
$125 a month or $1,250 a yearStart Advisor CustodyWhen an auditor samples the register. Ten seats, a shared register and a record of who opened each decision.
$10,000 a yearBook an evidence reviewCustody starts with a review of your evidence: write to sales@vciy.com.
Under Custody, records cannot be deleted or altered, by anyone, including you. Changes are new versions. The shared register and access history let the organisation trace both the decision and its review.
Community keeps 100 decision records. At that limit, every record stays readable and exportable, and the next new one needs Practitioner, which has no record limit. Read the retention and exit terms.