Where China and Global Threat Intelligence Converge
Most vulnerability scans generate hundreds of findings, leaving security teams to determine which ones represent genuine risk.
AI+ VSVP (Vulnerability Scanning and Verification Platform) is a vulnerability scanning and verification platform that scans your assets, verifies exploitable vulnerabilities and delivers validated, prioritised security reports – complete with risk context, recommended actions, and guidance for resolution. Combining Greater China and global threat intelligence through both the China National Vulnerability Database (CNVD) and Common Vulnerabilities and Exposures (CVE) database, AI-powered validation, Red-Team offensive scripts, and HKBNES’ security expertise, AI+ VSVP helps enterprises identify what truly requires attention, so security teams can spend less time investigating and more time remediating real risks.
Expert consultation is also available through selected service plans.
Why AI+ VSVP?
A More Comprehensive Picture of Threats
Most vulnerability management solutions view risk through a global lens. AI+ VSVP adds a regional perspective.
By combining threat intelligence from both the CNVD and the CVE database, AI+ VSVP delivers broader visibility across Greater China and global threat landscapes. Where applicable, AI+ VSVP also incorporates vulnerabilities affecting the Xinchuang ecosystem.
The result is a more complete picture of risk – helping enterprises identify emerging threats, zero-day vulnerabilities, and security exposures that may otherwise go undetected.
AI-Powered Validation with Red-Team Offensive Scripts
Not every vulnerability represents a genuine threat. Yet security teams often spend valuable time investigating findings that pose little real-world risk.
AI+ VSVP helps separate genuine vulnerabilities from false alarms through AI-powered analysis, Red-Team offensive scripts, and payload verification, reducing false positives to below 5%* – enabling teams to focus on real risks with greater confidence.
Actionable Findings
Security teams don’t need more data. They need clarity on what requires attention first.
AI+ VSVP’s detailed reports translate complex security findings into clear priorities – helping both management and technical teams align on what matters most, allocate resources effectively, and take decisive action.
Enterprise-Proven Security Expertise
Effective cybersecurity requires expertise built on real-world experience.
AI+ VSVP brings together HKBNES’ enterprise security expertise, Shanghai Jiao Tong University’s research know-how, and Shanghai Sunglow Information Technology’s operational, incident response, and Red-Team capabilities – helping organisations navigate security challenges with practical guidance and real-world insight. Selected service plans also include access to security specialists for consultation and support.
How AI+ VSVP Compares
| Capability | AI+ VSVP | Enterprise-Grade Scanning Tools Designed for large enterprises with dedicated cybersecurity budgets and security teams | Traditional Vulnerability Scanners Scanning and reporting are carried out by the service provider on behalf of the customer | |
|---|---|---|---|---|
|
Vulnerability & Threat |
Dual CNVD and CVE intelligence coverage, including relevant Xinchuang ecosystem vulnerabilities, for broader visibility across Greater China and global threat landscapes |
Primarily relies on globally recognized CVE intelligence and does not incorporate vulnerability intelligence from the CNVD, potentially reducing visibility into regional threats, vulnerabilities, and asset exposure information | ||
| Validation & Verification |
AI-powered validation and Red-Team verification help distinguish genuine risks from false alarms before action is taken |
Large volumes of findings that could necessitate additional manual investigation and validation | ||
| Scanning Coverage |
Covers websites and web applications, with the flexibility to extend scanning to servers, employee devices, and other network equipment as required |
Primarily focused on network device; website scanning requires an upgrade to an advanced plan |
Focuses on websites and external-facing assets, with no stated support for continuous internal asset scanning | |
| False Positives |
Low false-positive rate |
Traditional tools generally have a false positive rate of around 20-30%* |
Claims to reduce false positives, but no public data on false positive rates has been disclosed | |
| Reporting & Communication |
Management-friendly reporting that translates technical findings into clear business priorities and recommended actions |
Technical reports are provided, with customers responsible for interpretation and follow-up actions |
Assessment findings are primarily delivered in a technical report format, which may require technical expertise for interpretation and action planning | |
| Security Expertise |
Backed by HKBNES security expertise and top university research and incident response partnerships |
Tool-generated assessments with limited access to expert guidance |
Service provider-led scanning and reporting | |
AI+ VSVP provides vulnerability assessment, validation, and risk prioritisation services based on available threat intelligence, technical validation methods, and information provided by the customer. Findings, recommendations, and risk assessments are intended to assist security decision-making and do not guarantee the identification, prevention or remediation of all vulnerabilities, threats, attacks or security incidents. Actual results may vary depending on the customer’s environment, systems, configuration, and other factors. Terms and Conditions apply.
Website and web application scanning are included as part of the standard service scope. The scope of assessment may be extended to cover servers and other network devices, subject to the customer’s IT environment, business requirements, and the applicable service plan. Different asset types and scanning requirements may require different assessment methodologies and service configurations. Please contact our consultants for further evaluation and recommendations.
* The “below 5% false positive rate” and “traditional tools generally have a false positive rate of around 20-30%” figure is based on testing conducted by Shanghai Sunglowsec Information Technology using specific test environments and parameters against publicly available test targets. Actual results may vary depending on the customer’s environment, system configuration, threat landscape, scan scope and testing conditions. The results are provided for reference only and do not constitute a guarantee of performance.
