Which exposure should we fix first, and why?
Massar turns a host scan into a ranked list of what to fix first. It maps how an attacker could chain a host's vulnerabilities into attack paths, then ranks them by likelihood times impact.
A single host can return hundreds of vulnerabilities. A list sorted by severity tells you which are scary, not which are reachable, or which one fix removes the most risk. Massar answers the question a defender actually has: what do I fix first, and how sure are you.
nmap finds the open ports and the software behind them.
each service gets a standard software id, a CPE.
NVD and CISA supply its known vulnerabilities.
what each weakness grants becomes a map of routes.
each route is scored: how likely, times how bad.
Massar scores where an attacker ends up. A longer route that reaches root can outrank a scarier single finding that goes nowhere.
Everything shown is a hypothesis, never a confirmed break in. Every link says how we know it: observed, measured, derived or assumed. Every score shows its own arithmetic.
The model judges how plausible each route looks and writes the plain language why. Delete every AI verdict and the ranking is unchanged, a test proves it.
A capstone measured in working software. Each step made the last one real.
One thin slice running end to end on sample data, every stage a real function, so the seams were proven before the depth went in.
Live NVD and CISA KEV, matched by version range rather than exact strings, so a scanned service meets its actual CVEs.
Deterministic chaining by privilege: a step is added only when one weakness grants what the next one needs. The ranking became explainable arithmetic.
A live Metasploitable host, hundreds of findings turned into a ranked, grouped worklist in seconds. The tool stopped being a demo.
A model that judges plausibility and writes the explanation, wired in so it can never invent a route or move one up the list.
Provenance on every link, a coverage line so an empty result never reads as safe, and every score opening to show its own math.
Questions, a demo, or a collaboration? Reach us by email.
[email protected]