Free tools Windows power users keep installed
One-click scans. No signup required.
Prioritize vulnerabilities by combining four questions: Can an attacker reach the asset? Is exploitation happening or easy to automate? What technical and business damage would follow? and Can the fix be completed and verified safely? This risk-based exposure-management method prevents a high CVSS score from automatically displacing a lower-scored flaw that is internet-facing, actively exploited, and connected to a critical service.
What risk-based exposure management changes
A traditional vulnerability queue often sorts findings by severity score, then works downward. That is simple, but it treats a vulnerability on an isolated test server the same as one on an exposed identity system. Risk-based exposure management instead ranks the combination of attack opportunity and business consequence.
As an Amazon Associate I earn from qualifying purchases.
CISA’s Binding Operational Directive 26-04 describes the purpose clearly: “This approach focuses patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally.” The directive applies to U.S. federal civilian executive-branch agencies. Private organizations can use the same decision logic, but should set their own deadlines according to exposure, evidence of exploitation, impact, operational constraints, and risk appetite rather than treating federal requirements as universal law.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The result is not a single replacement score. It is a repeatable decision process that joins asset context, exposure, exploitation intelligence, technical severity, business criticality, remediation difficulty, and proof that the risk was actually reduced.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The signals that should drive priority
1. Asset ownership, exposure, and reachability
Start with the asset, not the CVE. Maintain an inventory that identifies the system owner, hostname or application, software version, environment, business service, data handled, dependencies, and existing controls. Record whether the asset is:
- Directly reachable from the public internet;
- Reachable from an untrusted partner, supplier, guest, or third-party network;
- Reachable only from an internal segment;
- Isolated, powered off, or otherwise not reachable through an attacker-accessible path.
CISA defines a publicly exposed resource as an agency-owned or agency-managed information-technology resource reachable by unauthenticated or untrusted entities over public networks. In a private environment, apply the same technical test while also recording exposure through remote-access gateways, cloud control planes, identity providers, software-management systems, and supplier connections.
Reachability is more than a yes-or-no internet flag. A vulnerable database may be private but reachable through a compromised application server. A management interface may be protected by a VPN yet exposed to thousands of contractor accounts. An asset that sits on an attack path to a crown-jewel system deserves a higher position than an identical flaw on a disconnected workstation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →2. CISA KEV status and observed exploitation
Mark every finding that appears in CISA’s Known Exploited Vulnerabilities (KEV) Catalog. KEV inclusion is evidence that the vulnerability has been exploited in real-world attacks, making it a stronger urgency signal than severity alone. Check the catalog when new findings arrive and during every queue review; status can change after initial triage.
KEV status does not eliminate the need for context. A KEV flaw on a retired, unreachable asset may require less immediate work than a non-KEV flaw exposed on an identity service with a plausible attack path. Conversely, an exposed KEV vulnerability on a critical service should normally move to the front of the queue, with an immediate mitigation if the permanent patch cannot be deployed safely.
3. EPSS as a probability signal
The Exploit Prediction Scoring System (EPSS) is a data-driven machine-learning model that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. FIRST publishes a probability from 0 to 1 and a percentile every day for every CVE. Treat those values as changing evidence, not a permanent risk label.
EPSS helps distinguish vulnerabilities that are technically severe but unlikely to be used soon from flaws with a meaningful near-term exploitation likelihood. It should be read alongside exposure, asset value, and exploitability conditions. A high EPSS value on a nonreachable laboratory host may not outrank a moderate EPSS value on an exposed payment service. Conversely, a low current EPSS value is not proof that exploitation is impossible.
Capture the date on which an EPSS value was collected. A daily refresh means that two queue exports can contain different probabilities for the same CVE without either being erroneous.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
4. Exploit automation and attack practicality
Ask how much skill, access, and time an attacker needs. Prioritize vulnerabilities for which exploitation is automated or readily incorporated into scanning and attack tools. Consider whether an exploit requires authentication, a user to open a file, a specific configuration, or a chain of weaknesses. Also consider whether public proof-of-concept code, mass scanning, or commodity tooling lowers the cost of attack.
Automation matters because a flaw that can be exploited at scale can create a large exposure window even when each individual asset appears modest. Document the evidence used for this judgment: observed probes, security-team telemetry, vendor advisories, threat intelligence, or a validated exploit condition. Do not label a vulnerability “automated” merely because a proof of concept exists.
5. Technical impact, including CVSS
CVSS remains useful for describing technical severity: privileges required, user interaction, attack complexity, confidentiality, integrity, and availability effects. Use the vector and the affected component to understand what a successful exploit could accomplish.
Do not use CVSS as the complete business-priority rule. UK NCSC vulnerability-management guidance says organizations “shouldn’t make decisions based purely on a single severity score, such as CVSS.” A high CVSS score on a system with no attacker path may be less urgent than a lower score that gives access to a critical service. Record the CVSS version and vector when available so that analysts can distinguish a change in scoring methodology from a change in the vulnerability itself.
6. Business consequence and recovery difficulty
Translate technical impact into consequences for the organization. Record whether the asset supports:
- Identity, authentication, remote access, or security administration;
- Customer-facing or revenue-generating services;
- Financial, health, legal, personal, or regulated information;
- Operational technology, safety-related processes, or physical equipment;
- Backups, deployment systems, source code, or other systems that can amplify compromise.
Estimate the effect of confidentiality loss, unauthorized changes, service interruption, fraud, safety incidents, regulatory exposure, and recovery time. Include dependencies: a vulnerable middleware component may be more consequential when it serves several business applications. Compensating controls such as segmentation, allowlists, web-application filtering, least privilege, multifactor authentication, or an effective virtual patch can reduce practical exposure, but they must be documented and tested rather than assumed.
A repeatable prioritization workflow
Step 1: Establish a trustworthy inventory
- Collect assets from authoritative sources. Reconcile endpoint, cloud, application, container, network, identity, and configuration inventories. Record an owner and a business service for each asset.
- Attach software and version data. A finding without a reliable version, instance, or package path cannot be assigned confidently or verified later.
- Map data and dependencies. Identify sensitive data, upstream and downstream systems, backup paths, administrative interfaces, and attack-path relationships.
- Record controls and lifecycle state. Note segmentation, authentication requirements, monitoring, maintenance windows, end-of-life status, and whether the asset is active, dormant, or scheduled for retirement.
Inventory quality is a priority-control issue. If ownership or exposure is unknown, assign an investigation task immediately; an unclassified internet-facing asset should not wait behind well-understood internal findings.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsStep 2: Classify exposure and attack paths
- Confirm whether the vulnerable service is reachable from the public internet.
- Check access from untrusted partner, supplier, guest, remote-access, and cloud-management networks.
- Identify whether the service is reachable through another compromised host or application.
- Record authentication, network filtering, segmentation, and monitoring that change the practical attack path.
- Link the asset to the business service and its most sensitive downstream dependency.
Use evidence from firewall and load-balancer rules, cloud security groups, route tables, identity policies, external attack-surface discovery, and application architecture. Do not infer exposure solely from an asset’s IP address or from a scanner’s default classification.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Step 3: Add exploitation evidence
- Check the CVE against the CISA KEV Catalog and record the result and review date.
- Capture the current EPSS probability and percentile, noting the daily observation date and the 30-day forecast window.
- Assess exploit automation, public exploit availability, observed scanning, and relevant threat activity.
- Check whether your own telemetry shows exploitation attempts, suspicious authentication, abnormal process execution, or lateral movement.
Separate evidence from assumption. “No exploitation observed” means your monitoring has not detected it; it does not mean the vulnerability is safe.
Step 4: Assess impact, effort, and outage risk
Use CVSS and the vendor’s technical advisory to describe the direct effect of exploitation. Then add business criticality, data sensitivity, safety implications, recovery difficulty, and the possibility that the flaw enables further compromise.
At the same time, document the remediation path: available patch or upgrade, restart requirements, compatibility work, maintenance window, rollback plan, and test coverage. Effort and outage risk should affect the treatment plan and sequencing, not excuse an exposed critical vulnerability. If a patch needs extended testing, apply a temporary control that measurably reduces exposure.
Step 5: Rank the queue with explicit decision rules
A practical queue can use the following order of consideration. It is a decision framework, not a universal numeric formula:
| Decision factor | Questions to answer | Effect on priority |
|---|---|---|
| Public or untrusted-network exposure | Can an unauthenticated or untrusted party reach the vulnerable function? | Raises priority, especially when no strong compensating control exists. |
| KEV or observed exploitation | Is the CVE in CISA’s KEV Catalog, or is exploitation visible in relevant telemetry? | Usually moves the finding toward immediate mitigation or remediation. |
| EPSS likelihood | What is the current 0–1 probability and percentile for the next 30 days? | Raises or lowers urgency as a time-sensitive probability signal. |
| Exploit automation | Can attackers exploit it at scale with commodity tools or little skill? | Raises priority because the attack cost and potential volume are lower. |
| Technical impact | What privilege, data access, code execution, integrity loss, or availability loss follows? | Raises priority when compromise enables broad control or destructive effects. |
| Business criticality | Does the asset support a crown-jewel service, safety function, regulated data, or recovery system? | Raises priority even when the technical score is moderate. |
| Attack-path position | Can this host provide a route to identity, administration, backups, or other sensitive systems? | Raises priority when it is an effective stepping stone. |
| Remediation and outage risk | How quickly can the fix be deployed and what could it interrupt? | Determines sequencing, testing, and temporary controls; it should not hide risk. |
| Compensating controls | Is access restricted, monitored, segmented, or virtually patched, and has that control been validated? | May reduce residual exposure when evidence shows the control works. |
| Fix verification | What scan, configuration check, version check, or test will prove the risk is removed? | Determines whether the item can be closed or must remain open. |
When factors conflict, give precedence to combinations that create a realistic, high-consequence attack path. An exposed, exploited, automatable vulnerability connected to a critical service should outrank an isolated vulnerability with a higher CVSS score.
Illustrative queue: why context changes the order
The following example is hypothetical and shows how the method works; it is not a claim about any specific CVE or product.
| Finding | Context | Decision | Reason |
|---|---|---|---|
| Finding A | Moderate technical severity; internet-facing remote-access service; listed in KEV; exploitation can be automated; service protects privileged accounts. | Immediate mitigation and expedited patching. | Exposure, observed exploitation, automation, and identity impact combine into a high-probability, high-consequence path. |
| Finding B | High technical severity; internal development workstation; no route from untrusted networks; strong endpoint controls. | Schedule with the normal high-severity maintenance cycle while validating isolation. | The technical consequence is serious, but current reachability and controls reduce near-term attack opportunity. |
| Finding C | Lower technical severity; public application gateway; EPSS probability is rising; exploit requires no authentication; gateway serves customer records. | Prioritize ahead of Finding B and deploy a temporary filter if the patch needs testing. | Exposure, unauthenticated access, changing exploitation likelihood, and data sensitivity create meaningful near-term risk. |
| Finding D | High technical severity; legacy appliance scheduled for retirement; isolated network; compensating access control verified. | Document the exception, maintain the control, and track retirement with an expiry review. | Residual risk may be acceptable temporarily only with an accountable owner and evidence that the exposure remains constrained. |
Turning a ranking into action
Assign ownership and a target date
Every prioritized item needs a named technical owner and an accountable business owner. Set the target date from the combination of exposure, exploitation evidence, impact, and risk appetite. There is no universally applicable remediation service-level number established for every organization; copying a generic deadline can make a queue look compliant while leaving the most dangerous paths exposed.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →For urgent findings, state the first containment action separately from the permanent fix. Examples include removing public access, disabling the vulnerable function, restricting management interfaces, isolating the host, applying a vendor mitigation, or adding a narrowly scoped filtering rule.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Define the treatment and rollback
Record the patch, upgrade, configuration change, code change, replacement, isolation, or retirement that will address the finding. Include prerequisites, test environment, maintenance window, backup or rollback method, and who approves a service interruption. If a temporary control is used, state how it will be monitored and when it expires.
Verify that the exposure is gone
Closing a ticket because a deployment job completed is not proof of remediation. Choose a verification method before implementation:
- Rescan the affected asset with a tool that can identify the corrected version or configuration;
- Confirm the installed package, firmware, or application build directly;
- Test the vulnerable function under the same access conditions an attacker would have;
- Validate that the public route, account, permission, or configuration causing exposure no longer exists;
- Check dependent hosts and replicated images so the vulnerable component is not reintroduced.
ENISA guidance calls for planned scans, prompt handling of vulnerabilities critical to operations, and records showing timelines, responsible employees, mitigation plans, and verification of fixes. Preserve those records with the finding.
Handling exceptions and deferred remediation
Sometimes a patch cannot be deployed immediately because of safety testing, vendor dependence, unsupported software, or a required outage. Deferral is a risk decision, not a closure state. Document:
- The specific reason remediation is deferred;
- The affected asset, service, data, and attack path;
- Residual risk after each compensating control;
- The accountable business owner who accepts that risk;
- An expiry or review date and the event that triggers earlier reassessment;
- The permanent remediation plan, dependencies, and verification method.
NCSC states: “The decision not to fix an issue is, at root, a senior-level business risk decision, not an IT problem.” Management review should be visible for high-consequence exceptions. Reassess the exception when KEV status changes, EPSS rises materially, exposure expands, a control fails, or the business service changes.
CVSS, KEV, EPSS, and exposure: what each can and cannot tell you
| Signal | What it measures | What it does not establish | Best use |
|---|---|---|---|
| CVSS | Technical severity and the conditions and consequences represented by a scoring vector. | Whether your asset is reachable, whether attackers are targeting it, or how important the business service is. | Describe technical impact and compare similar technical conditions. |
| CISA KEV | That a listed vulnerability is known to have been exploited in the wild. | That every instance is equally exposed or that a non-listed CVE is harmless. | Escalate findings with real-world exploitation evidence. |
| EPSS | A 0–1 probability estimate and percentile for exploitation of a published CVE in the next 30 days, refreshed daily by FIRST. | A guarantee of exploitation, a measure of business impact, or a substitute for asset context. | Add a current, time-sensitive likelihood signal. |
| Exposure and reachability | Whether an attacker can access the vulnerable function and how it connects to other systems. | How severe the technical result will be after compromise. | Determine practical attack opportunity and attack-path position. |
| Business impact | Consequences for services, data, safety, regulation, revenue, and recovery. | Whether exploitation is technically feasible. | Set the consequence side of the priority decision. |
Operating capabilities that support the method
A platform is useful only when it supplies reliable evidence for the decisions above. Look for capabilities that can:
- Maintain asset ownership, software versions, business services, and data classifications;
- Discover internet-facing and untrusted-network exposure, including cloud and remote-access paths;
- Ingest KEV status, EPSS observations, vendor advisories, and internal detection data;
- Map vulnerabilities to attack paths, identities, dependencies, and compensating controls;
- Assign owners, track target dates, record exceptions, and preserve approvals;
- Trigger rescans or other verification checks and distinguish fixed, mitigated, and unverified states.
Organizations without sufficient staff may use managed vulnerability assessment or remediation advisory services, while penetration testing can validate high-value attack paths and compensating controls. These services complement, rather than replace, ownership, business-impact decisions, and verification inside the organization.
Recommended Free Tools
Failure modes and how to correct them
Sorting only by CVSS
Problem: The queue favors a severe but unreachable flaw over an exposed, exploited moderate flaw.
Correction: Make exposure, KEV, EPSS, automation, asset criticality, and attack-path position mandatory fields in triage.
Treating an internet-facing label as permanent
Problem: Cloud rules, load balancers, VPN routes, and supplier connections change faster than the inventory.
Correction: Reconcile exposure continuously or at a defined review cadence, and preserve the evidence used for each decision.
Using EPSS as a verdict
Problem: A probability estimate is treated as a promise that exploitation will or will not occur.
Correction: Record the daily observation date and combine EPSS with reachability, KEV, telemetry, and impact.
Closing after deployment without verification
Problem: A patch reaches one node while a replica, image, appliance, or alternate route remains vulnerable.
Correction: Rescan or test the actual exposure, check dependent instances, and keep the item open when evidence is incomplete.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAllowing exceptions to expire silently
Problem: A temporary control becomes the de facto permanent solution without renewed risk acceptance.
Correction: Require an accountable owner, expiry date, residual-risk statement, and management review.
Measuring activity instead of risk reduction
Problem: Teams celebrate tickets closed while exposed assets, KEV findings, or unverified fixes remain.
Correction: Track whether attack opportunity and business risk actually declined.
Metrics that show whether prioritization works
Use metrics to test the decision system, not to create a new quota that encourages low-value patching. Useful views include:
- Time from discovery to confirmed owner and business service;
- Age and count of exposed findings, especially those in KEV;
- Exposure duration for internet-facing vulnerable services;
- Share of findings with current EPSS, asset criticality, and attack-path context;
- Time from prioritization to mitigation, permanent remediation, and verification;
- Number and age of exceptions, including those without a current business approval;
- Reopened findings caused by incomplete deployment, drift, or failed verification;
- Coverage of assets, software versions, cloud resources, and externally reachable services in the inventory.
Review these measures by business service and exposure class. An improving average can hide a dangerous backlog if exposed identity, remote-access, backup, or recovery systems are not separated from ordinary internal assets.
Implementation checklist
- Inventory assets, software, owners, services, data, dependencies, and lifecycle state.
- Identify public, untrusted-network, remote-access, cloud-management, and indirect attack paths.
- Record KEV status and current EPSS probability, percentile, and observation date.
- Assess exploit automation, public exploit evidence, internal telemetry, and required attacker access.
- Use CVSS to describe technical severity, then add business consequence, safety, regulation, and recovery difficulty.
- Document compensating controls and validate that they actually constrain exposure.
- Assign an owner, business owner, treatment, target date, rollback plan, and verification method.
- Mitigate immediately when permanent remediation needs testing or an outage window.
- Rescan or otherwise verify the affected exposure before closing the finding.
- Record and review every exception with residual risk, expiry, and accountable approval.
- Refresh exposure and exploitation evidence as network paths, KEV status, EPSS, and business services change.
Conclusion
Risk-based exposure management is a disciplined way to spend limited remediation capacity where attackers have the best opportunity and the organization has the most to lose. Use exposure and attack-path context to establish opportunity, KEV and EPSS to add current exploitation evidence, CVSS to describe technical effect, and business criticality to set consequence. Then convert the ranking into owned work, temporary protection where necessary, and independently verified closure. That combination is more defensible than any single severity score and gives security and business leaders a common basis for deciding what must happen first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
