# Precursor Intelligence for IT teams

> Precursor Intelligence gives small IT teams one ranked list of the security flaws in the software you actually run, scored 0 to 100 by evidence of real attacks, severity and exposure. We keep watching and email you as soon as something affects you and, when you want them, AI action plans that write up the fixes step by step, so you patch the right thing first.

Canonical page: https://www.precursorintelligence.com/for/it-teams

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact

## Why is my patch list so long?

Because most tools sort by how bad a flaw could be in theory. Of over 400,000 known flaws, fewer than 1 in 100 score Critical with us today. We also match flaws to the products you track, so the rest never reaches your list.

Every known flaw (over 400,000) in a recent snapshot, rounded:

| Band | Score | Flaws (about) | Share |
|---|---|---|---|
| Critical | 85 and above | 1,200 | 0.3% |
| High | 70 to 84 | 1,900 | 0.5% |
| Medium | 40 to 69 | 227,000 | 56% |
| Low | 20 to 39 | 81,000 | 20% |
| Info | 0 to 19 | 96,000 | 24% |

## How does a flaw get to the top?

Each score weighs four things, and evidence that criminals are actually exploiting it counts most. Scores are kept up to date as the evidence changes.

| Part | How much it counts |
|---|---|
| Evidence it is being exploited | The biggest factor |
| How severe it is | A strong factor |
| How widely exposed it is | A smaller factor |
| Threat activity | A smaller factor |

- **Exploited means now.** Anything confirmed exploited is marked "Emergency patch", whatever its score.
- **Rumours are not enough.** A report that a group uses a flaw can raise its score, but cannot make it Critical on its own.
- **The same rules for everyone.** Every flaw is scored by the same four parts, so the order follows the evidence, not the severity rating alone.

Illustrative example: a flaw rated 9.8 for severity that nobody is exploiting might score 44 (Medium), while a flaw rated 7.5 that criminals are using now might score 88 (Critical, Emergency patch).

## How does it fit into your work?

It runs in the background. These are the moments you'll actually touch it.

- **When something new affects you: read one email.** We watch continuously for newly published flaws, newly confirmed exploitation and rising exploit likelihood in the software you track. As soon as we spot something that matches, it lands in your inbox and in the app, in one email.
- **When you plan what to fix: start from the top of the list.** Your list is already sorted. If you want it written up, an AI action plan turns your top risks into an ordered, step-by-step plan you can share as a PDF. It is a dated snapshot, not a task tracker.
- **After you change something: scan and compare.** Run an attack-surface scan whenever you like and compare it with the last one: new hosts, open ports, services and certificates. You start each scan on a paid plan; running it uses no credits and unlocking results does.
- **Whenever code changes: check the dependencies.** Paste or upload your developers' npm (package.json, package-lock.json, pnpm-lock.yaml, yarn.lock) or Python (requirements.txt) dependency file; every package is checked against known supply-chain incidents. Saved files stay under watch and you are told if a new incident hits one you use. No credits.
- **When someone asks how things stand: download a report.** Download a PDF risk register of your matched vulnerabilities, your latest scan or an organisation summary. Reports are made on demand.

## Where do the results go?

- Email and in-app alerts to one shared list of recipients for your organisation.
- Webhooks send alerts as JSON to any tool that accepts one, with an optional secret header.
- Keyword rules, such as a product and a version, to catch flaws by name.
- A REST API for your own scripts, at 60 calls a minute, paid for with credits.
- Invite as many people as you like.

## What does it not do?

- No agents. Nothing is installed on your machines, so it cannot see inside your network.
- No scheduled scans. You start attack-surface scans when you want them.
- No ticketing connectors. There is no built-in link to service desk tools; use a webhook or the API.
- Not a task tracker. Action plans are dated documents; you cannot tick off or assign items.

## Questions IT teams ask us

### How do you know what software we run?
You tell us. Either pick products from our catalogue, or let us suggest them from your public website, which takes about 5 to 30 seconds. You review the list before anything is saved. We cannot see anything behind a login.

### Do I need to install an agent?
No. There is nothing to install on your machines or network. Findings come from public internet data, the software you tell us about and files you choose to upload.

### How often is it updated?
We monitor continuously and keep every known flaw's score up to date as the evidence changes. As soon as we spot a newly published flaw, newly confirmed exploitation or rising likelihood in your software, we tell you.

### Does it connect to our ticketing system?
Not directly. There is no built-in connector for service desk or ticketing tools. You can send alerts as JSON to a webhook your tools accept, or pull data with the REST API.

### Is the attack-surface scan safe to run?
It maps what your domain exposes to the internet, such as hosts, open ports, services and certificates. It is discovery, not a penetration test, and does not attack anything. You start each scan yourself, whenever you choose.

## Related

- Business owners: https://www.precursorintelligence.com/for/business-owners
- Security teams: https://www.precursorintelligence.com/for/security-teams
- MSPs: https://www.precursorintelligence.com/for/msps
- Pricing: https://www.precursorintelligence.com/pricing