ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable

ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable

Open-source cybersecurity company ProjectDiscovery Inc. today added Neo Triage to its Neo security testing platform to confirm which reported vulnerabilities can actually be exploited before teams start fixing them.

The new capability goes after the triage backlog, which ProjectDiscovery blames on artificial intelligence. Scanners, AI code review and AI-assisted bug hunting now turn up findings faster than security teams can get through them. Each of those findings still has to be reproduced by hand, and the company said that takes anywhere from 15 minutes to four hours apiece.

Neo Triage tries to reproduce every incoming finding against the live asset it was reported on. The tests run from an isolated sandbox, and ProjectDiscovery said they are built not to damage the systems being probed.

Each check ends with a verdict such as valid, duplicate or spam, and the exact traffic from it goes to the reviewer as evidence. Severity follows from the impact the test demonstrated. Neo also looks at how exposed the asset is, what data sits behind it and what else an attacker could reach from it.

The findings themselves can come from HackerOne Inc., GitHub security advisories, security mailboxes and scanners such as Qualys Inc. and Orca Security Ltd., and all of them land on a single board. Any other tool with an application programming interface can be connected too.

Once a finding is confirmed, Neo suggests a fix and drafts a reply to the researcher who reported it. A retest runs on its own after the change ships. An insights dashboard tracks the open backlog and service-level agreement status, and it also grades each source on the quality of what it sends in.

Rishi Sharma, co-founder and chief executive of ProjectDiscovery, expects triage to be the biggest problem security teams face over the next six to 12 months. Most organizations already have thousands of findings open, he said, and some have millions. “The hard part now is deciding which findings matter, and a score can’t make that decision,” Sharma said. “Proof can.”

The company estimated that working through a backlog of 100,000 findings by hand would take about 50,000 hours, enough to keep 25 people busy for a year. Reviewing Neo’s verdicts on the same backlog would come to roughly 8,300 hours by the company’s count.

ProjectDiscovery is a venture capital-backed startup that raised $25 million in a Series A round led by CRV in 2023. Its best-known tool is Nuclei, an open-source scanner that the company says has logged more than 10 billion scans. Neo, which runs on the set of tools that grew up around it, went on sale in March and became generally available in August.

Neo Triage is available now in every Neo tier, the free one included. Getting started on Neo costs nothing, with monthly usage included and no time limit, and heavier users can move up to Pro or Enterprise plans that run under zero data retention.

Image: ProjectDiscovery