NEMESIS audits every vulnerability suppression, acceptance, and exception record in navi.db — surfacing stale justifications, expired waivers, and accepted-risk entries that have outlived their rationale. It makes the hidden visible again.
Capabilities
- Queries navi.db for all suppressed and accepted findings
- Flags entries past their review date or with no expiry set
- Scores exception quality — vague justifications ranked for review
- Gated exception report — proposed, previewed, sent only on confirm
What NEMESIS Audits
NEMESIS reads every "accepted risk" and "suppressed finding" in navi.db and asks whether the justification still holds — whether the exception has expired, whether the original approver is still accountable, and whether the suppressed finding has since been exploited in the wild.
Why It Matters
Suppressions are where risk hides. A waiver written two years ago for a temporary workaround is now a permanent blind spot. NEMESIS ensures every exception is justified, current, and reviewed — so your risk posture reflects reality, not administrative convenience.
Gate Model
Every exception report is proposed and previewed before delivery. NEMESIS requires explicit per-call confirmation. Works entirely from navi.db — no external feeds.