Hey, my startup is a platform for automated penetration testing (so white hat hacking of your own infrastructure). There are several straightforward ways to track CVEs, and you can also automate parts of the patching process (such as with dependabot, since you mentioned Github advisories). Those can inform you of specific bugs in common software but doesn't tell you much about your security posture. For example your in house software could be buggy, or your environments could be mis-configured. At this point CVEs are reactionary. Everyone (including criminals) are finding exploits to common software at about the same time which means patches come weeks after the bugs start getting exploited in the wild.

A criminal who thinks you have something worth stealing will set up an agent to attack your systems. The bottom line is that a cheap LLM in 2026 is far more capable than than the best unassisted human hacker. CVEs put both the attacker and defender on notice, but they are are a tiny part of what goes into making a well defended system.