---
title: "Continuous risk detection | Cloudsmith"
description: "Continuous risk detection from Cloudsmith surfaces newly disclosed risks automatically with continuous monitoring of packages against the latest security advisories.\n"
canonical_url: "https://cloudsmith.com/product/continuous-risk-detection"
last_updated: "2026-08-17T12:03:26Z"
---
# Continuous risk detection | Cloudsmith

Continuous risk detection

## ** Know the moment a package ** in your repository becomes a risk.

Continuously monitor your open source packages against the latest vulnerability and malicious package intelligence. When new threats are published, we check for matches so your view stays current.


[Get a demo](https://cloudsmith.com/book-a-demo)

[Assess your security posture](https://cloudsmith.com/resources/artifact-security-maturity-tool)

## One place to see risk.

Every package in your registry is checked against live threat intelligence, not just the ones passing through a pipeline right now. New CVEs and malicious packages are matched the moment they publish, and that view is shared by every pipeline and developer pulling from the repository.

Outcomes

## Continuous risk detection with Cloudsmith

### Draw from the open-source community's own threat intelligence

Community-vetted feeds - Ingest and normalize vulnerability and malicious-package intelligence from OSV.dev, the open-source ecosystem's own intelligence feed.



Continuous updates - Poll for new advisories on an ongoing basis, so newly published intelligence reaches your repository without waiting for the next scan cycle.



Complements your SCA stack - Sits alongside your existing scanning and SCA tools, checking every package at ingestion and continuously afterward. 

### Identify risk continuously

Risk identification - Identify risk the moment intelligence updates, advisory data stays continuously refreshed and checked against your registry.



Automatic policy actions Ship with confidence as matches feed straight into policy, so risk gets acted on automatically.




### Prioritize what matters

EPSS-driven prioritization - Prioritize what matters most with EPSS scores that surface exploitability probability alongside severity.



Malicious packages identification - See malicious packages flagged distinctly in the UI and API, not folded into a generic vulnerability list.




### Pinpoint risk inside your containers

Container component mapping - Map components of container images to known risk.



Precise vulnerability location - Pinpoint which component carries a vulnerability for patching.





Speak to a Cloudsmith expert about protecting your organization from supply chain threats.

[Get a demo](https://cloudsmith.com/book-a-demo)

## Frequently Asked Questions

### What does "continuous risk detection" actually mean?

It means your open-source packages get checked against vulnerability and malicious package intelligence as new threats come in, not just at scan time. So if a CVE drops on a Tuesday afternoon, you find out that day because it is surfaced in our webapp, via API, and policies are automatically applied, not whenever your next scheduled scan happens to run.

### How is this different from a regular vulnerability scan?

A scheduled scan only tells you what's true at that moment. The problem is everything that happens after, new CVEs and malicious packages get published constantly, and a package that looked fine yesterday can be flagged today. Continuous detection closes that gap by checking against fresh advisory data as it updates.

### Why do the packages already in my environment matter as much as new ones?

Because that's usually where the blind spot is. Teams tend to scan packages going into a build, but the ones that already made it through don't get rechecked unless something is actively watching for new intelligence. Those are the ones most likely to have risk that isn’t managed because they aren’t being actively checked. 

### What is PURL-based matching?

PURL stands for Package URL, it's a standard format for identifying a package (think ecosystem, name, and version, all in one string). Matching against PURLs is fast and lightweight compared to heavier scanning methods, which is why it's used here to keep pipeline impact minimal.

### What's the difference between an EPSS score and a CVSS score?

CVSS tells you how bad a vulnerability could theoretically be. EPSS tells you how likely it is to actually get exploited in the wild in the next 30 days. Used together, they help you tell the difference between "technically severe but unlikely to be targeted" and "moderately severe but actively being exploited" which matters a lot when you're deciding what to fix first.

### Can you tell which specific part of a container image is vulnerable?

Yes, rather than flagging the whole image, component mapping identifies exactly which piece inside it (a specific library or dependency) is tied to the vulnerability. That's what makes it possible to patch the actual problem instead of guessing.