Open data

Stage Coverage Matrix, as data

The vendor directory scores each product 0, 1 or 2 on the five CTEM stages. Here is that matrix on its own, as CSV and JSON, with no editorial copy. Reuse it with attribution.

Version: 2026-09-20 (20 September 2026) · Vendors: 17 · Licence: CC BY 4.0

Download

Download CSV Download JSON

The full directory, with editorial copy, is at /vendors.json.

Fields

One row per vendor, sorted by slug. The CSV uses RFC 4180 quoting and CRLF line endings; in the JSON the five scores sit under a stages object.

Field	Meaning
`slug`	Stable identifier; matches the vendor page URL.
`name`	Product name.
`company`	Company that sells it.
`tier`	Listing tier. See the disclosure on the about page.
`scoping … mobilisation`	scoping, discovery, prioritisation, validation, mobilisation: 0 = none, 1 = partial, 2 = full.
`reviewed`	Date of our last review, YYYY-MM-DD.
`url`	Vendor product page.

The 0, 1 and 2 definitions for each stage are in How we score each stage. Scores are our reading of public documentation.

How to cite

Cite the version, not just the site, so a reader can find the same numbers.

CTEE. Stage Coverage Matrix, version 2026-09-20. https://ctee.org/data (accessed 2026-10-27).

Generated at build time from the vendor directory data. The version is the newest review date in it, so it changes only when a score or review date changes.

KEV with EPSS, updated daily

Every entry in the CISA Known Exploited Vulnerabilities catalogue, joined with its FIRST EPSS exploitation-likelihood score and a CTEM stage. The feed is regenerated each day from both public sources. Published as CSV and JSON under CC BY 4.0.

Download CSV Download JSON

Each file carries its own catalogue version, EPSS score date and generation time. Cite those with any figure.

Licence: CC BY 4.0. The JSON holds the licence, attribution, source versions and mapping rules in its header. The CSV is data rows only, so parsers read it unchanged; the same version details are shown here and in the JSON.

Stage mapping

KEV and EPSS are inputs to Prioritisation, so every row is tagged ctemStage: prioritisation. nextStage says where the exposure goes next: validation when EPSS is at least 0.1 or not yet scored, and mobilisation below that. The rule is versioned in the file as mapping.version.

MTTR and SLA calculator

Paste your own findings with open and close dates to get mean time to remediate, SLA attainment and items past target. The calculator runs entirely in your browser. Open the calculator.