COMPENSATING CONTROLS ADVISOR

GHOST DEFENSE // TOOL 43 · DEFEND ALWAYS · WHEN YOU CAN'T PATCH YET

NO KEV

📁 KEV

HOW THIS WORKS — compensating controls buy time when a fix isn't available or isn't deployable yet (no patch, budget-locked hardware, change-window constraints). The tool maps a vulnerability's weakness class (CWE) to control families, filters them by the CVSS attack path, and maps each to NIST 800-53 / CIS Controls. It proposes control families — you confirm what's actually deployable in your environment. It is not a substitute for patching; it's what holds the line until you can.

VULNERABILITYwhat are we compensating for

CVE ID (optional)

CVSS v3 vector — drives which controls apply to the attack path

Weakness type (CWE) — the mitigation backbone

Context

No patch available / can't patch yet

budget-locked, no fix released, or change window blocked

Internet-facing / externally exposed

reachable from outside your perimeter

COMPENSATING CONTROL PLAN—

NO PLAN YETAdd a CWE (and optionally a CVSS vector + context), then GENERATE.