Sign in to CVA

CVA is a fully cloud-hosted service — SD Corp runs and maintains the platform, so there's nothing for your team to install, patch, or babysit. What you get: some of the fastest CVE alerts available the moment a critical CVE hits your vendor stack, scheduled digest alerts on the cadence you choose, and ongoing access to the risk analysis data behind every alert.

Ahead of NVD, measured. CVA watches for new disclosures around the clock, so a new CVE from the vendors CVA tracks reaches CVA within minutes of being published, before the National Vulnerability Database lists it. In the last 30 days CVA caught 2,150 CVEs ahead of NVD, typically 48 minutes earlier and up to 1.7 hours. Many scanners and alert feeds get their CVEs from NVD and sync hourly or daily, so they see a new CVE later still.

Where the data comes from

CVA aggregates authoritative public vulnerability intelligence (the NIST National Vulnerability Database, the CVE Program, CISA's Known Exploited Vulnerabilities catalog and Vulnrichment data, and FIRST's EPSS) together with continuous monitoring of public exploit and proof-of-concept repositories. CVA's own analysis layer correlates these to track vendor disclosure behavior, patch availability, and exploitation status for the vendors you care about.

After you sign in

1. 1 Sign in with MicrosoftWe recognize your organization automatically from your work account.
2. 2 Tell us where to send alertsA 30-second form — just the inbox for CVE alerts.
3. 3 We activate your accountOur team reviews and reaches out — most orgs are live within one business day.

What we see when you sign in

You enter your password directly with Microsoft — CVA never sees or stores it. Once you approve, Microsoft hands back three things: your name, your work email address, and your organization's Microsoft account ID. Your name and email are the same information already visible in your company directory and email signature — nothing hidden. The account ID isn't a credential either; it's just how Microsoft tells us which organization you belong to, the same way a company domain does. We don't request access to your mailbox, files, or anything beyond that basic profile.

Why teams choose CVA

• ☁️ Fully Cloud-HostedWe host, patch, and maintain the platform — nothing for your team to run.
• 🚀 Fastest CVE AlertsNew CVEs within about a minute of publication, ahead of NVD and the tools that wait for it.
• 🗓️ Scheduled Alert DigestsA recurring summary on the cadence you choose, so nothing gets lost between real-time pings.
• 📊 Full Analysis Data AccessQuery and explore the risk analysis data behind every alert, not just the headline.