How to automate CVE monitoring for your stack with AI, a cron job and Slack

Microsoft fixed more than 1,400 CVEs on a single Patch Tuesday this month, a record (BleepingComputer). Nobody on your team read all of them, and nobody should have to.

The job was never "know every CVE". The job is knowing, by the time you have had your coffee, which of yesterday's vulnerabilities touch something you run, whether anyone is exploiting them, and what to do about it today. Keyword alerts cannot answer that. A product-subscription feed gets you halfway: it tells you a CVE exists for your firewall, but not that it is being exploited, not that the fix also needs a credential rotation, and not about the vendor breach that never got a CVE at all.

This guide sets up a daily vulnerability brief that answers those three questions. Every morning a scheduled job sends your stack to Valyu DeepResearch. DeepResearch reads CISA's Known Exploited Vulnerabilities catalog, NVD, EPSS, vendor advisories, GitHub Security Advisories, threat intelligence and the security press, keeps only what affects you, and posts a cited brief with a CSV to Slack, Teams or wherever your team works. Setup takes about ten minutes. A standard brief costs 100 credits, about $0.63.

Tested on 23 October 2026 against the live Valyu API.

TL;DR

• The problem is triage, not discovery. 2026 is on course for a record number of CVEs, but only a small fraction are ever exploited. You need the handful that matter to you, with evidence.
• The setup: the open-source cve-monitor GitHub Action (or any scheduler) calls the DeepResearch API with your stack, waits for the report, checks KEV status against CISA's feed and posts a summary, the PDF and a CSV to Slack. You add one short workflow file.
• What you get: "act today", "plan this week" and "watching" items, each with the CVE or advisory ID, exploitation status, KEV status, the fixed version and a source link.
• What it catches that feeds miss: advisories with no CVE ID yet, compromised package releases and vendor breaches.
• Run it however suits you: on demand in the DeepResearch playground, scheduled in Slack or Microsoft Teams with Valyu's hosted bots, on GitHub Actions with the open-source Action, or through the API into any channel you like.
• Cost: a fast brief is 25 credits (about $0.16) and a standard brief is 100 credits (about $0.63). New accounts get $10 of free credits, or $20 with a company email.

If you're an agent: Fetch www.valyu.ai/agents.md and follow it to set up Valyu, then come back to this page.

If you're a human: Start free and get an API key.

MCP onboarding: Connect your agent to https://mcp.valyu.ai/mcp and follow the MCP setup guide. The valyu_deepresearch tool runs the same research from inside Claude, ChatGPT, Cursor or Claude Code.

What is automated CVE monitoring, and why do keyword alerts fail?

Automated CVE monitoring is a scheduled process that checks new and updated vulnerabilities against the software you run and tells you which ones need action. Keyword alerts fail at it for three reasons: there is too much volume, there is no context, and some of the riskiest items have no CVE at all.

Volume. CVE publication has been climbing for years and AI-assisted vulnerability discovery has pushed it higher again in 2026 (FIRST's 2026 forecast update). A filter on "Microsoft" or "critical" still returns hundreds of items a month.

Context. A CVSS score tells you how bad a bug could be, not whether anyone is using it. Google's threat intelligence group puts exploitation at around 0.23% of 2026 disclosures (GTIG). The useful questions are whether a CVE is in CISA KEV, what its EPSS score is, whether the vendor has confirmed exploitation, and what the fix involves.

No CVE yet. Two briefs we ran on 23 October, each looking back seven days, flagged three items with no CVE ID: a critical Next.js remote code execution advisory that shipped with only a GitHub advisory ID (GHSA-673q-mjm6-r5xr), a compromised LiteLLM release on PyPI and Docker Hub, and the GhostAction campaign pushing malicious GitHub Actions workflows. None of them would have matched an alert keyed on CVE IDs.

Which sources should a CVE monitor watch?

A good CVE monitor watches at least six kinds of source, because each answers a different question. No single feed is enough.

This is why a research agent works better than a feed here. A feed matches identifiers. DeepResearch reads across all six and cites every claim, so you can see where they disagree. For the field that must never be wrong, KEV status, cve-monitor checks CISA's feed itself.

How do you scope alerts to your own tech stack?

Write your stack down as a plain list of products, with versions where you know them. That list is the most important input to the whole setup: the brief can only be as specific as the stack you give it.

Fortinet FortiGate (FortiOS 7.4), Citrix NetScaler ADC 14.1, Microsoft 365 and Exchange Online,
Windows 11, Windows Server 2022, Chrome and Edge, Okta, VMware ESXi 8 and vCenter 8, Veeam Backup & Replication,
AWS (EKS, RDS for PostgreSQL, S3, IAM), Kubernetes, Java 21 with Spring Boot, Node.js 22 with Next.js,
Python 3.12 with FastAPI, GitHub Actions, Jira and Confluence Cloud, Slack, Debian and Alpine base images

Some rules of thumb:

• Start at the edge. VPNs, firewalls, load balancers, remote-access and RMM tools are where most mass exploitation happens.
• Include identity, CI/CD and SaaS vendors. A breach at a vendor you depend on is as urgent as a CVE in your own code.
• Add base images and runtimes. PHP, Node.js, Python, Java and OpenSSL fixes often need a rebuild, not just a package update.
• Leave out anything sensitive. Product names and versions are enough. Do not send hostnames, IP addresses, credentials or customer data to any research service.

How do you run DeepResearch for your stack, on demand or on a schedule?

There are four ways, from no setup at all to full control. All four run the same research and return the same cited brief.

1. Run it yourself, on demand. Paste your stack and the question into the DeepResearch playground, run valyu deepresearch create from the Valyu CLI, or call the API. This is the right tool when a big advisory lands and you want an answer for your stack in the next twenty minutes, and a good way to try the brief before you automate it.
2. Off the shelf, in Slack or Microsoft Teams. The hosted Valyu Slack bot (slack.valyu.ai) and Valyu Microsoft Teams bot (teams.valyu.ai) run a DeepResearch prompt daily or weekly and post the cited report, with a PDF, to the channel you choose. Install the app, paste a Valyu API key and write your stack into the prompt. No code, no infrastructure.
3. Open source, on GitHub Actions or cron. cve-monitor runs the brief on a schedule, saves it as Markdown, PDF and CSV, checks every CVE against CISA's KEV feed and posts a summary to Slack. This is the version walked through below.
4. Your own pipeline, into any channel. The brief comes back as Markdown, a PDF and a CSV, so it can go anywhere your team already works: a Teams or Discord webhook, a Jira or ServiceNow ticket, PagerDuty for the "act today" items, or your SIEM. Call the API from your own scheduler, or have DeepResearch call you with a webhook (see below). For email, add alert_email to the request (or --alert-email in the CLI) and the finished report arrives with the PDF and CSV attached. The address must belong to someone in your Valyu organisation.

If you want a hand wiring it into your SOC tooling, ticketing or SIEM, email us at contact@valyu.ai.

The three API calls

Every version does the same three things: create a task, poll its status, then read the result. This minimal script shows the whole idea in about 40 lines of curl and jq.

#!/usr/bin/env bash
# Plain curl: create a DeepResearch task, poll it, post the result to Slack.
# Needs curl and jq.
#   export VALYU_API_KEY=...       # https://platform.valyu.ai/user/account/apikeys
#   export SLACK_WEBHOOK_URL=...   # a Slack incoming webhook
#   bash vuln-brief.sh
set -euo pipefail
API=${VALYU_BASE_URL:-https://api.valyu.ai/v1}
START=$(jq -rn 'now - 2 * 86400 | strftime("%Y-%m-%d")')   # two days ago, UTC
 
# 1. Create the task. Save the returned deepresearch_id.
#    (To be called back instead of polling, add "webhook_url": "https://..." and
#    keep the webhook_secret from this response. It is only returned once.)
TASK_ID=$(curl -sS --fail-with-body -X POST "$API/deepresearch/tasks" \
  -H "X-API-Key: $VALYU_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg start "$START" '{
    query: "Which vulnerabilities published, updated or exploited since \($start) affect nginx, OpenSSH or PostgreSQL? Start with a section titled Summary: at most 5 bullets with CVE ID, product, exploited in the wild or not, and the action to take today.",
    mode: "fast",
    output_formats: ["markdown", "pdf"],
    search: { included_sources: ["cybersecurity", "web"], start_date: $start },
    deliverables: [{ type: "csv", description: "One row per vulnerability",
                     columns: ["cve_id", "product", "cvss", "epss", "in_cisa_kev", "fixed_version", "source_url"] }]
  }')" | jq -r .deepresearch_id)
echo "created $TASK_ID"
 
# 2. Poll the status endpoint until the task is completed, failed or cancelled.
while :; do
  STATUS=$(curl -sS --fail-with-body "$API/deepresearch/tasks/$TASK_ID/status" \
    -H "X-API-Key: $VALYU_API_KEY" | tee task.json | jq -r .status) || STATUS=retry
  echo "$(date -u +%T) $STATUS"
  case $STATUS in completed|failed|cancelled) break ;; esac
  sleep 10
done
 
# 3. Post the opening of the report plus links to Slack.
jq '{
  text: ("*\(.title // "Vulnerability brief")* (\(.status))\n\n"
    + ((.output // .error // "") | tostring | .[0:2500] | gsub("\\*\\*"; "*")
       | gsub("\\[\\[(?<n>[0-9]+)\\]\\]\\((?<u>[^)]+)\\)"; "<\(.u)|[\(.n)]>"))
    + "\n\n" + ([(.pdf_url // empty | "<\(.)|Report (PDF)>"),
                  (.deliverables[]? | select(.status == "completed") | "<\(.url)|\(.type | ascii_upcase)>")]
                 | join(" | ")))
}' task.json | curl -sS --fail-with-body -X POST "$SLACK_WEBHOOK_URL" \
  -H "Content-Type: application/json" --data @-
echo

The GitHub Action

The quickest setup is cve-monitor, an open-source GitHub Action and command-line tool we published for exactly this. It is one Python file with no dependencies beyond the standard library. Every morning it sends your stack to DeepResearch, saves the brief as Markdown, PDF and a CSV, checks every CVE in the findings against CISA's KEV feed so KEV status and due dates come straight from CISA, and posts a summary to Slack.

Set it up in four steps:

1. Create an API key at platform.valyu.ai.
2. In your repository, go to Settings, Secrets and variables, Actions and add it as the secret VALYU_API_KEY. For Slack, add an incoming webhook for a private channel as SLACK_WEBHOOK_URL.
3. Save the workflow below as .github/workflows/cve-monitor.yml on your default branch, with your own stack.
4. Run it once from the Actions tab. After that it runs every day at 07:17 UTC.

# Copy to .github/workflows/cve-monitor.yml in your repository.
#
# Settings > Secrets and variables > Actions:
#   VALYU_API_KEY      https://platform.valyu.ai/user/account/apikeys
#   SLACK_WEBHOOK_URL  optional, a Slack incoming webhook for a private channel
name: CVE monitor
 
on:
  schedule:
    - cron: "17 7 * * *" # 07:17 UTC daily. Off the hour, when GitHub's schedulers are less busy.
  workflow_dispatch:
 
permissions:
  contents: read
 
jobs:
  brief:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: valyuAI/cve-monitor@v1
        with:
          valyu-api-key: ${{ secrets.VALYU_API_KEY }}
          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
          stack: |
            Fortinet FortiGate (FortiOS 7.4)
            Okta
            Kubernetes 1.36
            Node.js 22
            PostgreSQL 16
 
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: cve-brief
          path: cve-brief/
          if-no-files-found: ignore
          retention-days: 30

The brief appears in the job summary, as a downloadable artifact and in Slack. To run it from cron or your laptop instead, use the same tool directly:

export VALYU_API_KEY=...
python3 cve_monitor.py --stack-file stack.txt          # writes cve-brief/report.md, report.pdf, findings.csv
python3 cve_monitor.py --stack-file stack.txt --dry-run   # prints the request, spends nothing

Three details from GitHub's documentation on scheduled workflows are worth knowing. Scheduled runs can be delayed or dropped at busy times such as the top of the hour, which is why this one runs at 17 minutes past. Schedules only run from the default branch. In public repositories, scheduled workflows are disabled after 60 days without activity.

How do you send the brief to Slack, Teams or email?

For Slack, use an incoming webhook and keep the message short: a header, the report's summary bullets, links to the full report and CSV, and a footer with the mode and source count. cve-monitor builds that message with Slack's Block Kit, turns the report's numbered citations into Slack links, and trims the summary to fit Slack's limits.

For Microsoft Teams, the Valyu Teams bot posts each scheduled report as a card with the summary, a link to the full report and a PDF download. If you would rather keep it in your own pipeline, post the same summary to a Teams workflow webhook. For email, alert_email delivers the report to an inbox when the task completes.

Two security notes:

• Post to a private channel. The PDF and CSV links are signed download links that work for anyone who has them.
• Keep reports private. A brief that names your stack is a map of your attack surface. cve-monitor never makes reports public.

Can you use a webhook instead of polling?

Yes. Add webhook_url to the create request and DeepResearch will POST the finished task to that HTTPS endpoint when it completes or fails. The create response includes a webhook_secret for that task. It is returned once, so store it.

Every delivery is signed. X-Webhook-Timestamp carries the Unix time in seconds, and X-Webhook-Signature carries sha256= followed by an HMAC-SHA256 of the timestamp, a full stop and the raw request body, keyed with the task's secret. Verify it before you trust the payload:

import hashlib
import hmac
import time
 
def verify(raw_body: bytes, timestamp: str, signature: str, secret: str) -> bool:
    if abs(time.time() - int(timestamp)) > 300:  # reject stale deliveries
        return False
    signed = f"{timestamp}.".encode() + raw_body
    expected = "sha256=" + hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Answer with a 200 quickly and do the delivery in the background. Deliveries are retried on server errors, so make your handler safe to run twice for the same task.

How do you alert only when something changes?

Keep the daily brief as your digest, and add a cheap trigger for the urgent case: a new KEV entry for a vendor you run. The KEV feed is a single JSON file, so a few lines of jq will tell you whether anything relevant was added since yesterday.

SINCE=$(date -u -d '1 day ago' +%F)   # GNU date; on macOS use: date -u -v-1d +%F
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
  | jq -r --arg since "$SINCE" --arg vendors "Fortinet|Citrix|Ivanti|Microsoft|Atlassian" '
    .vulnerabilities[]
    | select(.dateAdded >= $since)
    | select((.vendorProject + " " + .product) | test($vendors; "i"))
    | "\(.dateAdded)  \(.cveID)  \(.vendorProject) \(.product)"'

Run against the live catalog on 23 October 2026 with a 13 October start date, it returned four additions: Ivanti Connect Secure, Windows, Atlassian and Fortinet. BeyondTrust's 16 October addition did not appear because BeyondTrust is not in the vendor list. That is the point: the list is the filter, so keep it complete. Run it hourly and, when it prints anything, start an extra DeepResearch task scoped to that CVE so the right people get the fix and the compromise-check steps straight away.

What does it cost to run every day?

A standard daily brief costs 100 credits (about $0.63), which is about 3,000 credits or $19 for 30 days. Prices are a fixed amount per task, and a failed task is not charged (pricing).

160 credits equal $1. The first deliverable file in a task is included; each extra file is 16 credits. New accounts get $10 of free credits, which is 16 standard briefs, or $20 with a company email. A common pattern is fast mode on weekdays and one heavy brief on Monday morning for the weekly security review.

The CISA KEV, NVD, EPSS and MITRE ATT&CK datasets are built into DeepResearch on the Serious Business plan and while your free credits last. On other plans, DeepResearch reads the same public CISA, NVD and vendor pages from the web instead.

Can an AI agent set this up and run it for you?

Yes. If you use Claude Code, Codex, Cursor or another coding agent, paste this prompt into it:

Set up https://github.com/valyuAI/cve-monitor for this repository.
Read its AGENTS.md first and follow it.

The repository's AGENTS.md tells the agent what to ask you, where the workflow goes, how to store the API key as a secret without ever seeing it, and to check the setup with a free dry run before anything is charged. For Valyu more broadly, point your agent at www.valyu.ai/agents.md: it installs the Valyu CLI, signs in through your browser and installs the Valyu skill.

From the CLI, the same brief is one command:

valyu deepresearch create "Which vulnerabilities published, updated or exploited in the last 2 days affect: <your stack>? Start with a Summary of at most 5 bullets." \
  --mode standard \
  --deliverable "CSV: cve_id, product, severity, exploited_in_the_wild, in_cisa_kev, fixed_version, action, source_url" \
  --watch

Agents connected to the Valyu MCP server can call valyu_deepresearch directly, check progress with valyu_deepresearch_status and read the finished report back into the conversation.

How do you check the brief before acting on it?

Treat the brief as a well-sourced first draft from a researcher, not as an oracle. Every factual claim carries an inline citation, so verification is quick:

• Confirm the fix against the vendor advisory before it goes into a change ticket. Distribution backports and vendor version tables can differ from the upstream version number.
• Check KEV status in the KEV feed itself, not in a news article. cve-monitor does this automatically and adds the KEV date added, due date and ransomware flag from CISA to every row of the CSV. In our own testing this mattered: on one large run, the model marked five KEV-listed CVEs as not in KEV, and the feed check catches exactly that.
• Hunt for compromise as well as patching when the brief says exploitation began before the patch. A patch closes the hole; it does not remove an attacker who is already inside.

DeepResearch does not scan your environment, test your exposure or deploy patches. It tells you what changed in the world and what that means for the stack you described. Your scanners and asset inventory remain the source of truth for what is actually running.

How does this compare with OpenCVE, CVEFeed and other CVE alert tools?

Product-subscription tools are good at telling you, quickly, that a CVE exists for something you watch. DeepResearch is good at telling you what to do about it. Most teams benefit from both.

How do you keep up with security news without reading it all?

Use the same workflow with a different question. Swap the stack query for a news brief scoped to your sector, and run it daily or weekly:

What were the most important cybersecurity developments of the last 24 hours for a
mid-size fintech in the UK and EU? Cover exploited vulnerabilities, breaches at vendors
we might use, regulatory deadlines (NIS2, DORA, the Cyber Resilience Act) and new
attacker techniques. Five bullets first, then one short section per item, cited.

A weekly heavy brief with a longer look-back makes a good input to a security leadership meeting: what changed, what we did about it, and what we are watching.

What does a real brief look like?

This is the brief cve-monitor produced at 11:35 UTC on 23 October 2026 for the example stack used in this guide, in standard mode with a seven-day look-back. DeepResearch read 121 sources and the run cost 100 credits. Here is the summary at the top of the report:

• Citrix NetScaler ADC 14.1: CVE-2026-107406 (CVSS 4.0 9.5) plus the September/October KEV chain. Exploitation is confirmed for CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779 (all CISA KEV); CVE-2026-107406 itself is not in KEV and Citrix reported no unmitigated exploits at publication. Upgrade to 14.1-73.46. Earlier builds that cleared the September KEV entries still fail CVE-2026-107406, and builds 14.1-73.37 to 73.41 remain exposed as a SAML IdP. Patching does not evict an implant: preserve evidence and check for compromise first.
• Fortinet FortiOS 7.4: CVE-2025-61624, exploitation confirmed. CISA KEV added 16 October (federal due 19 October). Unit 42 traced it to one telecom intrusion dating from September 2024: attackers breached FortiManager via CVE-2024-47575, exposing configurations for 500+ firewalls, then used CVE-2025-61624 to gain root and plant PEERSTITCH malware on a select number of them. Affected 7.4.0 to 7.4.9, fixed in 7.4.10. Separately, a CVE-less hardening release on 22 October requires 7.4.13; 7.4.10 does not satisfy it.
• Windows 11 / Windows Server 2022: CVE-2026-96951, exploitation confirmed. Windows Shell Mark-of-the-Web bypass, CVSS 8.8, CISA KEV 13 October, due 16 October; deploy to user endpoints first. KB5126655 (Windows Server 2022), which also carries the fix for this flaw, can break on-premises Exchange: keep the update and raise the RPC Endpoint Mapper cap.
• Node.js 22: CVE-2026-111497 (Node2Shell), no in-the-wild exploitation reported. Out-of-bounds write in the bundled Brotli decoder; Node.js rates it High and says it permits RCE; a working RCE proof of concept exists on an official Node.js 24 build (22.x not tested). Fixed in 22.23.4.
• GitHub Actions: GhostAction and actions-cool, two separate credential-theft incidents, no CVE. GhostAction pushed malicious workflows through about 1,900 hijacked GitHub accounts from 8 October: revoke the credentials that pushed them and rotate the secrets those workflows could reach. For actions-cool/issues-helper and maintain-one-comment, rotate secrets exposed to workflows that ran them by tag between 16 and 25 September, and pin actions to full commit SHAs.

Excerpt from a Valyu DeepResearch brief generated on 23 October 2026, edited for accuracy after we checked it against vendor advisories, CISA and Unit 42. The original attributed Unit 42's 500+ firewall figure to the wrong CVE, implied a Node.js proof of concept ran on 22.x, and merged the two GitHub Actions incidents into one. Check vendor advisories before acting.

Three things about this brief are worth noticing. One of the five items has no CVE at all (the GitHub Actions compromises), and the Fortinet item flags a CVE-less hardening release that a CVE feed would never show. Every item says whether exploitation is confirmed, attempted or not reported. And when cve-monitor checked the 43 CSV rows that carry a CVE ID against CISA's KEV catalog (the other five are advisories with no CVE), it caught one the model had got wrong: VMware vCenter CVE-2026-59310 was marked as not in KEV, although CISA listed it on 18 August with known ransomware use. The kev_listed column carries CISA's answer. That is why the tool does the check.

• Read the full brief (unedited output. Only the summary above was fact-checked. Its Fortinet section repeats the 500+ attribution error and scores CVE-2025-61624 at CVSS 8.6, where Fortinet says 6.0 and NVD 6.5.)
• Download the CSV (48 rows, including the KEV columns from CISA's feed).

Frequently asked questions

How do I get CVE alerts in Slack?

Create a Slack incoming webhook, then run a scheduled job that collects new vulnerabilities for your stack and posts them to the webhook. The open-source cve-monitor GitHub Action does this with Valyu DeepResearch, and the Valyu Slack bot does it without code.

Is there a free feed for CISA KEV additions?

Yes. CISA publishes the Known Exploited Vulnerabilities catalog as a free JSON feed and CSV, and offers email updates. The jq snippet in this guide checks the JSON feed for new entries from your vendors.

How often should a CVE monitor run?

Run a full brief once a day, and a cheap check of the KEV feed every hour or two. Daily is frequent enough for planning; the hourly KEV check covers the urgent case where a product you run is added to KEV.

Can I monitor CVEs for specific products only?

Yes. Put the products, and versions where you know them, in the stack list. The workflow passes it to DeepResearch, which ignores anything that does not touch those products.

How do I avoid alert fatigue?

Send one digest a day instead of one message per CVE, lead with a short summary sorted by urgency, and reserve real-time pings for KEV additions that match your stack. Ask the brief to separate "act today" from "plan this week" and "watching".

Does this replace a vulnerability scanner?

No. A scanner tells you what is installed and vulnerable in your environment. A daily brief tells you what changed in the outside world and what it means for your stack, including issues that scanners cannot see yet, such as advisories with no CVE or a breach at a vendor.

How much does a daily run cost?

A fast brief is 25 credits (about $0.16) and a standard brief is 100 credits (about $0.63), so a daily standard brief is about $19 for 30 days. Failed tasks are not charged, and new accounts get $10 to $20 of free credits.

Can I run it without GitHub Actions?

Yes. cve-monitor runs from crontab, a Kubernetes CronJob or any job runner with python3 cve_monitor.py --stack-file stack.txt. The Valyu Slack bot and Valyu Microsoft Teams bot schedule reports with no code at all, and the DeepResearch playground runs a one-off brief in your browser.

Can I get the brief in Microsoft Teams or email instead of Slack?

Yes. The hosted Valyu Teams bot schedules daily or weekly reports into a Teams channel, and adding alert_email to a request emails the finished report with the PDF and CSV attached. Because the brief is plain Markdown, a PDF and a CSV, you can also send it to Discord, Jira, ServiceNow, PagerDuty or a SIEM from your own code.

Can I get help setting it up?

Yes. Email contact@valyu.ai and tell us what you run and where you want the brief to land.

Start your first brief

Write your stack list, create an API key, add the cve-monitor workflow and run it once by hand. Setup takes about ten minutes, and the first brief lands in Slack when the run finishes, usually within 20 minutes in standard mode. Prefer no code? Install the Slack or Teams bot, or run a one-off brief in the DeepResearch playground. Want to see the research before you set anything up? Read this month's exploited-vulnerabilities report, which used the same DeepResearch API.

Start free with $10 of credits, or $20 with a company email. Questions, or want help fitting it into your stack? Email contact@valyu.ai.