Zafran vs Nucleus Security on the finding the score still calls critical

A CVSS 9.8 still opens the patch meeting after the library is not loaded in any process and a host control already drops the exploit. The severity number does not move, so the queue still starts there.

A scanner score describes the CVE. It does not say whether this asset is running the component, whether the asset is reachable, or whether a firewall, a WAF, or an EDR rule you already pay for blocks the exploit. Exposure prioritization is that decision. A second vulnerability scanner is a different purchase. A product that launches attacks at production is another one.

Zafran builds the rank from runtime, reachability, active exploitation, and the configuration of those existing controls, then names a policy change that can cut the risk before the patch window. Nucleus Security is the record the scanner findings land in: one score from 0 to 1000 that mixes vendor severity with asset context and threat signals, then a ticket to an owner.

If the purchase order says replace the scanner, neither product is that line. The scanners still produce the findings. These two argue about which finding is still worth a person’s week, and they do not argue it with the same inputs.

	Zafran	Nucleus Security
Primary use case	Decide which findings are still exploitable given runtime, reachability, threat activity, and controls you already run, then name a mitigation on those controls	Keep one record of findings from the scanners and cloud tools you already run, score it with asset context and threat signals, and route the ticket
What moves the rank	Whether the component is loaded, whether the asset is reachable, whether it is exploited in the wild, and whether an existing EDR, WAF, or firewall configuration already covers it	A 0 to 1000 score from the scanner’s severity and exploit attributes, plus asset attributes you weight from 0 to 10, plus threat flags such as CISA KEV and EPSS
Fast action before the patch	A policy-level change on a control you already own. Attack Chain Killswitch names a choke-point control, with a WAF rule as the published example	A weighted score and an automation rule that assigns an owner and a due date. The default score doc does not name a firewall or EDR policy change as the action
Day-to-day workflow	Connect existing scanners, EDR, and network controls. Review what is loaded and what a control already blocks. Open one remediation item for the finding that remains	Ingest scan results through connectors, set asset attributes and weights, read Top Risks, and let rules open tickets against the SLA
License/pricing	No public per-asset price. The Marketplace Unit is a 12-month contract whose counting rule is not published. See Editions	Documented as a fixed cost per asset per year, with no public per-asset dollar. The Marketplace Platform License is a 12-month dimension the listing says depends on asset count. See Editions
Who operates it	The security team reads exploitability. The control owner applies the policy change. The patch owner receives the work item	The vulnerability program sets weights and rules. Application and asset owners receive the tickets

Zafran

Nucleus Security

Zafran is still sold as Zafran. On 22 July 2026 it announced a strategic investment from Cisco Investments. The same day, CEO Sanaz Yashar told Globes that Zafran is not being sold to Cisco and that Cisco is participating in a financing round. Reported buyout talks are not a closed sale. No completed acquisition was on those sources on 3 Oct 2026. Nucleus Security is still the purchasable name. On 11 February 2026 it announced a $20 million Series C led by Delta-v Capital. That round is funding, not a change of owner.

Editions and pricing

Neither vendor posts a per-asset software price. The two Marketplace rows below are 12-month contract dimensions, each with the scope limit beside it. Anything beyond that row is quote-required.

	Zafran	Nucleus Security
How you buy it now	SaaS subscription to the Zafran Risk and Mitigation Platform, sold as Units. There is no public tier list. The exposure page says discovery uses the Zafran Detector on endpoint agents you already run, with no new agent to deploy	Two license tiers for unified vulnerability management. The pricing page does not name the tiers. The license page prices a fixed cost per asset per year across devices, web URLs, code and container repositories, and cloud resources
Public units (3 Oct 2026)	AWS Marketplace, sold by Zafran: $300,000 per 12 months for one Unit of the Zafran Platform. The listing says you can commit to more than one Unit. It does not say whether a Unit is an asset, an endpoint, or a user	AWS Marketplace, sold by Nucleus Security: $100,000 per 12 months for one Platform License dimension on Nucleus Enterprise Vulnerability Management Platform. The same listing says the price you pay depends on how many assets you have and which type. Treat that dimension as published, not a confirmed invoice, and not a per-asset rate
What does not consume a license	Not stated. Do not assume an unscanned inventory record is free or billable. The Unit definition was not on the listing	A host that has never been vulnerability-scanned does not count, including a CMDB or cloud inventory import with no scan results. A scanned asset with zero findings does count. Inactive or deleted assets stop counting. Several branches of one repository count once
Compliance label on the pages checked	The Marketplace listing names executive reporting for SOX, HIPAA, PCI-DSS, and SOC 2. A FedRAMP authorization for Zafran was not on the listing or the Killswitch post	The Helix release states FedRAMP Moderate authorization, and names support for federal civilian agencies, the Department of Defense, and defense-industrial contractors under CMMC 2.0 and NIST SP 800-171
Main buying consideration	Can you get the seller to define a Unit before you treat the 12-month row above as the price of the environment?	Are you buying asset capacity for findings that scanners already produce, knowing the Platform License dimension above is not the per-asset rate and Recorded Future is listed as sold separately?

What is allowed to move the rank

	Zafran	Nucleus Security
Runtime	The exposure page asks whether the vulnerability is loaded in runtime, using a runtime-aware software inventory from the Detector	Nucleus Security matches an asset from rest to runtime so the same asset is not counted twice across tools. That is deduplication. It is not a check that the vulnerable library is loaded in a process
Internet exposure	Internet exposure is one of the four questions on the exposure page, and Attack Chain Killswitch follows a path that starts at an internet-facing flaw	The default risk score marks Public-Facing automatically from the IP address. The prioritization page also lists internet exposure as a factor you can weigh. An IP flag is not the same object as a mapped path
Controls you already run	Zafran reads the configuration of existing defenses and can lower the applicable risk when a control already blocks the exploit. The Marketplace listing names EDR (CrowdStrike, SentinelOne, Defender), WAF, and next-generation firewall	The default score uses scanner attributes and asset attributes. A custom adjuster can use any field Nucleus stores, so a connector could bring a control note in. The published score steps do not read an EDR or firewall policy and drop the finding because that policy blocks it
In the wild, and chains	3 August 2026: Attack Chain Killswitch, written with Google Threat Intelligence (Mandiant investigations, VirusTotal, Google). It scores chains built from campaigns those sources are tracking, including low and medium findings a severity sort waves through, and surfaces one action that breaks the most chains. It maps the path. It does not launch the exploit	The prioritization page lists active exploitation, a public exploit, ransomware association, threat-actor activity, CISA KEV, and EPSS. Those flags change the finding’s weight. The 25 August 2026 Helix release does not describe a choke-point graph. Whether attack-path mapping shipped later was not on the pages opened
Main buying consideration	Does the rank have to fall when a control you already own covers the finding, or when the component is not loaded?	Does the rank have to be a number your team can reweight, using asset criticality and exploit evidence, without depending on a live control configuration?

Nucleus Security’s risk score is that ranking number on purpose: scanner severity and exploit attributes, then asset attributes weighted from 0 to 10. Zafran’s exposure page adds the control configuration and the runtime check. Zafran still produces a rank. The inputs are what differ.

What the ticket asks someone to do

	Zafran	Nucleus Security
Integrations	The Detector post (5 August 2025) says the Detector is available and needs no new agent: one API key to an EDR, cloud, or endpoint tool you already run. It names CrowdStrike, SentinelOne, Tanium, Intune, Jamf, and AWS SSM. The Marketplace listing also names WAF and next-generation firewall. Tickets go to Jira or ServiceNow	The remediation page describes bi-directional ticketing and ingest from scanners. Connectors and FlexConnect are how other findings arrive. A named EDR and endpoint list comparable to Zafran’s was not found on the remediation page or the 25 August 2026 Helix release. Recorded Future is sold separately on the Marketplace listing
Assets	The Detector post describes a profile per asset: what is running, whether the asset is exposed to the internet, the host firewall, and which security tools are installed or missing. The Marketplace Unit is a 12-month subscription. What one Unit counts was not found on the listing	License rules on the Nucleus license page: a host that has never been vulnerability-scanned does not count, including a CMDB or cloud import with no scan results. A scanned asset with zero findings does count. Inactive or deleted assets stop counting. Matching one asset from rest to runtime is deduplication. It is not a check that a library is loaded in a process
Ownership	The Detector post says RemOps opens a Jira or ServiceNow item and routes it to the owners. How the owner is chosen, beyond that route, was not found on that post	The remediation page says ownership metadata assigns the ticket, and it names a business owner and a technical owner on the asset. Automation rules set the owner and the due date from the SLA
Mitigation	The Detector post says Zafran lists mitigation actions on defenses you already run, and the control owner deploys them. Killswitch’s published case is a WAF rule. The patch is a separate ticket. This is not an unattended change to production	Nucleus finding status Mitigated is for a compensating control, or a fix confirmed by hand, with comments and evidence. It does not wait for a scanner. Status Fixed does wait for a scanner, and a later scan that still sees the issue returns it to Active. The status page does not say Nucleus reads an EDR or firewall policy and sets Mitigated by itself. Insights remediation guidance was available on 25 August 2026
The fast path	Mitigation on Killswitch is a compensating control at the choke point, applied in the control you already run. The published example is a WAF rule. The control owner still has to deploy it. Do not read the listing as an unattended change to production	Automation rules assign the finding, set a due date from the SLA, and alert the owner. The Helix release, citing IDC, keeps deterministic execution for actions that affect production. The AI layer proposes. It does not silently change a host
The patch path	Remediation is the patch or upgrade. Zafran opens a work item and routes it to the owner in Jira or ServiceNow. RemOps is the earlier name for collapsing overlapping CVEs into one remediation item	Ticketing integrations are manual or automated. Assets can be mapped to application owners so the ticket lands on the team that owns the stack. The finding stays the scanner’s finding, enriched, rather than a control-change request
What shipped recently	Attack Chain Killswitch on 3 August 2026, in the rank section. The older agentic exposure post (2 December 2025) is the query and remediation-plan layer under that, not a second product	25 August 2026: Nucleus Helix. Insights, including a threat-intel collection agent, remediation guidance, and CISA SSVC enrichment, was available with that release. Nucleus Discover, early warning before a scanner signature exists, and the Helix AI Agent, plain-language questions and workflow creation, were scheduled for September 2026. A later notice that either is available was not found
Main buying consideration	Is the item you need this week a control change at a choke point, with a patch ticket only for what that control does not cover?	Is the item you need this week one owner, one due date, and one record after the scanners have already disagreed?

Choose Zafran when the finding should drop because it is not loaded, or because an EDR, WAF, or firewall you already run covers it, and when the fast action is that control change. Choose Nucleus Security when the findings already exist in several scanners, the rank has to be a score you can weight, and the action is one record routed to an owner under an SLA, including the FedRAMP Moderate authorization stated on the Helix release.