Titan AI is in beta. Features and behavior may change, and some functionality is still in development. To share feedback or report an issue, complete the support form.
Supply chain detections can include hundreds of thousands, or even millions, of findings across vendors. To help you prioritize the issues that matter most, we provide robust filtering options to narrow results and focus on findings you want to review or resolve with your vendors.
Using filters
Filters can be applied in both the Group by Name view and the Findings view. Filters applied at the group level persist when you drill down into the individual finding. Any actions you take apply only to the currently filtered set of findings (at either level). The following filters are available.
Organization filters
Use organization filters to limit findings by company or portfolio ownership.
| Name | Type | Operators | Available to |
| Company Name | Multi-select | None | My Network |
| Portfolio | Multi-select | None | My Network |
Finding filters
Use finding filters to refine results based on finding-specific attributes.
| Name | Type | Operators | Available to |
| Flagged | Single-select | None | My Network |
| Threat level | Multi-select | None | My Company, My Network |
| My response | Multi-select | None | My Company |
| Vendor response | Multi-select | None | My Network |
| Asset type | Multi-select | None | My Company, My Network |
| Type | Multi-select | None | My Company, My Network |
| My Actions | Multi-select | None | My Network |
| Finding status | Multi-select | None | My Company, My Network |
| Last seen | Presets (last 24hrs, last 7 days, last 30 days, last 90 days) or Date Range | None | My Company, My Network |
| First detected | Presets (last 24hrs, last 7 days, last 30 days, last 90 days) or Date Range | None | My Company, My Network |
| Port number | Numeric value | is, is not, greater than, greater than or equal, less than, less than or equal | My Company, My Network |
| Remediation requested | Single-select | None | My Company |
| Asset | String | None | My Company, My Network |
| Requested by | Multi-select | None | My Company |
| Finding name | String | None |
My Company, My Network
|
Vulnerability data
Vulnerability data filters enable numeric and categorical filtering of vulnerability findings.
| Name | Type | Operators | Available to |
| CVSS Score | Numeric value (max = 10.0) | is, is not, greater than, greater than or equal, less than, less than or equal, in range | My Company, My Network |
| EPSS Score | Numeric value (max = 1.0) | is, is not, greater than, greater than or equal, less than, less than or equal, in range | My Company, My Network |
| Is CISA KEV | Single-select | None | My Company, My Network |
Use system filter presets
System filter presets are SecurityScorecard-curated filter sets that give you a ready-made triage lens without building one yourself. You can access them from the Presets menu in every VRM observation view. When you open VRM Observations for the first time, the Emerging Threat Watch preset is applied automatically, so your landing view focuses on high-confidence emerging threats.
The following system presets are available.
| Preset | Focus | What it surfaces |
| Active Compromise Indicators | Investigate now | Signals that appear in both active compromises and authorized security testing, such as Cobalt Strike C2 beacons, information stealers, remote access tools, botnets, and website defacement. External observation establishes the signal but not its meaning, so confirm intent through direct vendor engagement. |
| Ransomware Kill Chain | Critical risk | Exposed services and vulnerable products that recur in ransomware post-mortems, such as RDP, SMB, VMware ESXi, Log4j, and Pulse Connect Secure VPN. One finding is an exposure; two or more match the infrastructure profile seen in real incidents. |
| No Credentials Required | Critical risk | Internet-accessible services that lack an authentication barrier, such as unauthenticated Elasticsearch and MongoDB, LDAP anonymous binding, exposed VNC and Telnet, and internet-accessible industrial control system devices. |
| Actively Exploited CVEs | Critical risk | Vulnerabilities that carry two independent confirmation signals: a CISA KEV designation and an EPSS score at or above 0.5. These reflect observed attacker behavior rather than theoretical severity, and a patch closes the finding. |
| Emerging Threat Watch | Proactive (default view) | High-severity CVEs not yet on CISA KEV but showing signals that weaponization is imminent: an EPSS score above 0.7, a CVSS score at or above 7.0, and a first-seen date within the last 30 days. This preset is applied as the default view on first visit. |
| New this week | Stay current | Vulnerabilities, compromise indicators, and insecure endpoints first seen on a vendor's attack surface within the last 7 days, with a CVSS floor of 7.0 for vulnerabilities. This is a change-detection lens, not a severity assertion. |
You can apply a system preset, then layer additional finding filters on top to further refine the results. You cannot delete, rename, or edit a system preset. To customize one, select the Actions icon (...) and select Duplicate to add it to your saved filter, then edit the copy freely.
You can also set any preset as your default. Toggle Set as default on a system or personal preset so your landing view opens with the lens you prioritize.
Search for findings
Use the search to filter finding groups by Finding Name. Search works alongside filters to further reduce the visible results.