ProjectDiscovery Inc. has added Neo Triage to its Neo security testing platform, a capability the open-source cybersecurity company says confirms which reported vulnerabilities can actually be exploited before teams begin fixing them.
The tool targets the triage backlog, which ProjectDiscovery attributes to artificial intelligence. Scanners, AI code review and AI-assisted bug hunting now surface findings faster than security teams can process them, and each finding still has to be reproduced by hand, which the company said takes between 15 minutes and four hours apiece.
Neo Triage attempts to reproduce every incoming finding against the live asset where it was reported. The tests run from an isolated sandbox, and ProjectDiscovery said they are designed not to damage the systems being probed. Each check produces a verdict such as valid, duplicate or spam, and the exact traffic from the test is passed to the reviewer as evidence. Severity is derived from the impact the test demonstrated, and Neo also assesses how exposed the asset is, what data sits behind it and what else an attacker could reach from it.
Findings can come from HackerOne Inc., GitHub security advisories, security mailboxes and scanners such as Qualys Inc. and Orca Security Ltd., all landing on a single board. Any other tool with an application programming interface can also be connected. Once a finding is confirmed, Neo suggests a fix and drafts a reply to the researcher who reported it, and a retest runs automatically after the change ships. An insights dashboard tracks the open backlog and service-level agreement status and grades each source on the quality of what it submits.
Rishi Sharma, co-founder and chief executive of ProjectDiscovery, said he expects triage to be the biggest problem security teams face over the next six to 12 months. Most organizations already have thousands of findings open and some have millions, he said, and the hard part is deciding which findings matter. Sharma said a score cannot make that decision but proof can.
ProjectDiscovery estimated that working through a backlog of 100,000 findings by hand would take about 50,000 hours, enough to keep 25 people busy for a year. Reviewing Neo's verdicts on the same backlog would come to roughly 8,300 hours by the company's count.
ProjectDiscovery is a venture capital-backed startup that raised $25 million in a Series A round led by CRV in 2023. Its best-known tool is Nuclei, an open-source scanner the company says has logged more than 10 billion scans. Neo went on sale in March and became generally available in August. Neo Triage is available now in every Neo tier, including the free one, and heavier users can move to Pro or Enterprise plans that run under zero data retention.
More cybersecurity news from TechManNews.
