Plain English vulnerability monitoring

Know when your stack is at risk

StackFlag watches public vulnerability databases every hour and tells you what matters, why it matters, and what to do about it. No security expertise needed.

Get started free Sign in
0
Tracked vulnerabilities
0
Software products
0
Data sources
0
Minute data freshness
0
Critical this week
0
Known exploited (KEV)
Define your stack

Describe your setup in plain English - nginx, WordPress, PostgreSQL, Node.js, whatever you run. StackFlag sets up monitors automatically. No security expertise needed.

We flag what matters

When a vulnerability matches your stack, StackFlag flags it with a plain-English summary, severity rating, and what to do about it.

Get alerted your way

Email digests, instant alerts, or webhooks - choose how and when you hear about it. Triage with read/unread/acknowledge and keep an audit trail for compliance.

Built for teams with compliance obligations

Vulnerability monitoring is a named control in every major security standard. StackFlag provides the continuous monitoring and triage evidence these frameworks require.

ISO 27001: A.8.8
Management of technical vulnerabilities. StackFlag provides the continuous monitoring, severity prioritisation, and remediation records this control requires.
SOC 2: CC7.1
Monitor system components for anomalies. StackFlag's hourly scans and flag queue give auditors the evidence trail they ask for in Type II assessments.
Cyber Essentials (UK)
Patch high-severity vulnerabilities within 14 days. StackFlag flags CVSS ≥7 and KEV entries the moment they appear so you never miss the window.
NIS2 Directive (EU): Art. 21
Vulnerability handling and disclosure for essential and important entities. StackFlag tracks affected software and gives you the audit log to demonstrate active management.
PCI DSS v4: Req 6.3
Identify, rank, and remediate security vulnerabilities. StackFlag's CVSS-prioritised flag queue maps directly to the ranked patching workflow PCI DSS requires.
NIST SP 800-53: RA-5 / SI-2
Vulnerability monitoring and flaw remediation. StackFlag automates RA-5's continuous scanning requirement and provides the SI-2 remediation timeline evidence.
Data sources updated hourly:  NVD · GHSA · OSV · CISA KEV · EPSS · Vulnrichment