Public-source correlation only. No scanning, device access, patient data, or disruption of care. Every grade is evidence-bound and explained.

CINEOS Clinical Exposure Watch · CEW

Daily, explainable, evidence-grade intelligence for medical-device exposure.

CINEOS turns public advisories, CVEs, manufacturer publications, dependency records, and authorized validation evidence into decision-ready findings — clearly separating confirmed facts from open questions.

Passive by default. Public-source evidence first. No device probing, scanning, exploitation, authentication testing, or patient-care disruption.

Observe Most public-record findings begin at OBSERVE. We state what is proven, what is not proven, and what evidence would change the grade.

See the actual output

One finding, exactly as delivered

Demonstration finding based on public sources. Manufacturer and product identifiers are withheld from this public page pending responsible-disclosure and legal review. The named, evidence-linked version is available to qualified prospects under NDA.

CEW Finding — a syringe-infusion-pump family

Public advisory correlation · cew_f_demo01 · public-record sources only, no probing
Grade: Observe

Why Observe, not higher: new public signal; no confirmed exposed asset. It would be dishonest to grade this Act or Urgent without observing exposure — so we don't.

What is confirmed

  • 8 public CVE records, CVSS up to 8.1
  • Three CWE-798 hard-coded-credential weaknesses and a CWE-306 missing-authentication weakness, named in public advisories
  • Manufacturer and product family named in public record
  • Vendor remediation exists in later firmware

What is NOT confirmed

  • Whether any organisation currently deploys this device
  • Whether any unit is externally reachable (no probing performed)
  • Whether affected firmware is still in service vs. upgraded
  • Whether exploitation has ever occurred
Evidence — 8 public CVEs
CVECVSSWeakness
CVE-2017-127188.1CWE-120 · buffer overflow
CVE-2017-127208.1CWE-306 · missing authentication
CVE-2017-127248.1CWE-798 · hard-coded credentials
CVE-2017-127267.3CWE-798 · hard-coded credentials
CVE-2017-127215.9CWE-295 · improper certificate validation
CVE-2017-127255.6CWE-798 · hard-coded credentials
CVE-2017-127225.3CWE-125 · out-of-bounds read
CVE-2017-127233.7CWE-200 · information exposure

See how grades are earned

Evidence-based escalation

How CEW grades findings

Four tiers, decided by explainable gates — not a black-box score. A finding rises only when the evidence earns it, and it arrives with the reasoning that put it there.

Observe

Trigger

Public signal; no confirmed device linkage. → Monitor & enrich.

Verify

Trigger

Strong public link to a manufacturer / device. → Manufacturer security review.

Act

Trigger

Exposed pathway + relevant advisory or control plane. → Security, clinical eng, vendor.

Urgent

Trigger

Active exploitation or likely care-impact path. → Incident response & exec escalation.

Transparency under imperfection

We show our provenance — including the gaps

Every record declares how it was obtained. When something can't be fully verified, we say so plainly rather than paper over it. That honesty repeats across every finding.

NVD CVE records — fetched live, content-hashed

Retrieved HTTP 200 from the public NVD API and hashed. sha256:6b1e…verifiable at nvd.nist.gov

CISA advisory page — URL recorded, hash pending

The advisory host blocked automated retrieval (HTTP 403), so it is referenced by URL, not yet content-hashed. Recorded honestly — not fabricated.

What you get

Five outputs

01

Exposure dossiers

Per product family, from public sources.

02

SBOM verification

Declared vs. observable footprint.

03

Relevance feed

Daily; only what links to your graph.

04

Criticality routing

An action and an owner, not a number.

05

Evidence packets

Counsel-safe, disclosure-ready.

Who it's for

Built for the teams accountable for clinical technology

Same evidence discipline, framed to the question each team has to answer.

Medical-device manufacturer · PSIRT

Which public signals, dependencies, and exposure indicators may affect our product family?

Review the manufacturer workflow
Health-system security · clinical engineering

Which advisories are relevant to equipment we have authorized you to assess?

Review the health-system workflow
Insurer · risk team

Which medical-device exposure conditions are changing across an insured or portfolio population?

Discuss portfolio intelligence
Portfolio intelligence — emerging

The hard boundary

Passive, lawful, public-source — by design

The default product observes public record and preserves evidence. It never touches your environment. Active validation, if ever wanted, is a separate written-authorization engagement — legal review, named assets, safety controls, emergency stop — never our default.

scan or probe your networksaccess or authenticate to devices test credentialshandle patient datadisclose without your review

The business model, in one sentence

This finding is Observe because it rests on public record alone. Paid engagement determines external reachability.

$35,000 – $100,000

A 30-day diagnostic for one product family — three proof-grade findings and a disclosure-ready remediation map. Not a subscription.

Discuss an authorized pilot

Know what changed. Know what is proven. Know who should act.

CINEOS Clinical Exposure Watch (CEW) — passive, lawful, public-source intelligence. Findings restate already-public CVE/advisory records; no probing, scanning, or device interaction is performed.  ·  Plain-English overview