PRIORITIZE.
WHAT.
MATTERS.
Rogue reads the threat intel and tells you which attacks apply to your environment.
Know what to fix first, before the next incident decides for you.
GO ROGUEPatch the VPN gateway and confirm the fixed version.
Why Teams Choose Rogue
Most teams still patch by severity score, so everything looks urgent and the attacks that matter get lost in the queue. Rogue shows you the few likely to actually reach you, so you know what to fix first.
- 47%
- of new CVEs in 2024 were rated High or Critical
- NVD, 2024
- 10%
- of open vulnerabilities are fixed by teams monthly
- Cyentia Institute
- 1.1%
- of CVEs are publicly known to be exploited in the wild
- VulnCheck, 2014-2023
Real Risk
Spend your patching time on the vulnerabilities attackers actually use, not the ones that only score high.
Early Warning
Hear about an attack while it's heading your way, not after it shows up in your logs.
Answers
Ask about your threats in plain language by connecting Rogue's MCP server to your AI tools, starting with Claude.
Confidence
Know why each threat matters to you, so you can act without second-guessing and explain the call to anyone who asks.
Profile. Match. Act.
Tell Us About You
Share your industry, region and the products you run. Optionally connect Microsoft Defender Vulnerability Management for exact exposure, with more integrations coming. Read-only, no rip-and-replace.
Profile Matching
Threat intel is correlated against company-specific context signals so what surfaces is relevant to your environment, your industry, and threats actively targeting peers like you.
Prioritized Action
Rogue ranks each threat on exploitation, impact and exposure. Each threat card tells you why it matters to you, what to do now and what to do next.
Threat Intelligence & Forecasting
Matched against your exposure and ranked by likely impact.
Prioritized threat
- Tier
- T1 Act
- Status
- Active (12)
- CVSS
- 9.5
NetScaler pre-auth remote code execution
Why you
- All 12 of your NetScaler gateways run an affected build, and this flaw needs no special configuration to exploit.
- It has been used as a zero-day since early September to plant web shells and tunnel into internal networks.
All threats
| Threat | Tier | Likelihood | Why you | Assets | Status |
|---|---|---|---|---|---|
NetScaler pre-auth remote code executionCVE-2026-88771 | T1 Act | 97% | All 12 of your NetScaler gateways run an affected build, and this flaw needs no special configuration to exploit. It has been used as a zero-day since early September to plant web shells and tunnel into internal networks. | 12 | Active |
FortiOS SSL VPN out-of-bounds writeCVE-2024-21762 | T2 Attend | 85% | 2 of your FortiGate firewalls run SSL VPN on an affected FortiOS. | 2 | Active |
Ivanti Connect Secure authentication bypassCVE-2023-46805 | T2 Attend | 96% | Your 2 VPN gateways run Connect Secure. | 2 | Active |
Terrapin SSH prefix truncation attackCVE-2023-48795 | T3 Track | 94% | 2 of your Linux servers run an OpenSSH build before 9.6. | 2 | Partial |
Windows SmartScreen security feature bypassCVE-2023-24880 | T3 Track | 78% | 1 of your Windows devices is missing the March 2023 update. | 1 | Active |
- Tier
- T1 Act
- Status
- Active (12)
- CVEs
- CVE-2026-88771
- CVSS
- 9.5
- Sector
- Energy
- Location
- Norway
- Sources
- 6
NetScaler pre-auth remote code execution
Why you
- All 12 of your NetScaler gateways run an affected build, and this flaw needs no special configuration to exploit.
- It has been used as a zero-day since early September to plant web shells and tunnel into internal networks.
Immediate response
- 1Update all 12 gateways to 14.1-73.46 or 13.1-64.29 (or later).
- 2Hunt for web shells and tunneling tools before trusting the patched box.
Recommendations
- 1Check the gateways' logs since early September for unexpected requests and new admin accounts.
- 2Reset credentials for accounts that signed in through the gateways.
- 3Keep the gateways' management interface off the public internet.
What's our most urgent threat?
get_threat_detailsWhat else is open?
get_threatsStart Free, Scale Later
Starter
For teams getting started with Rogue.
- Continuous threat intel
- Threats matched to your business
- Connect your first security tool
- Standard support
Enterprise
For organizations with custom requirements and scale.
- Everything in Starter
- Dedicated support
- Custom terms and invoicing
- Adapted to how your team works
Microsoft Defender Vulnerability Management and Rogue MCP connections are available on every plan.
Is Rogue a SIEM or alert triage tool?
No. Rogue doesn't read your logs or alerts. It watches the threat landscape and tells you which reported attacks are likely to matter to you next, so you can act before they show up in your environment.
Do I need to connect my security tools?
No. Your industry, region and tech stack are enough to get started. Connecting Microsoft Defender Vulnerability Management adds your exact exposure, so threats are matched to the devices and software you actually run. More integrations are coming at a later date.
What access to Microsoft Defender does Rogue need?
Read-only access to your vulnerability and software inventory data. Rogue never stores a secret of yours, and you can revoke access from Entra at any time.
How does Rogue decide what to prioritize?
Each threat is weighed on three things: is it being exploited, how big is the impact, and are you exposed. The more of them apply, the higher it ranks, from Track to Attend to Act. The tiers are based on CISA's SSVC decision model. Threats actively hitting companies in your industry or region move up.
How often is the threat intel updated?
Rogue checks for new threat intel every hour, and your Defender exposure syncs every 6 hours.
Can I use Rogue from Claude?
Yes. Connect Rogue's MCP server and ask about your threats, assets and campaigns in plain language, in Claude on the web, desktop, phone or in Claude Code. It's read-only and sees only your organization's data. The Security tools page in the dashboard walks you through connecting it.
Is there an AI assistant inside Rogue?
Rogue Agent, an AI assistant built into the dashboard, is on the way.