ProjectDiscovery Adds Neo Triage to Confirm Vulnerability Exploitability

The capability addresses the triage backlog that ProjectDiscovery attributes to artificial intelligence. Scanners, AI code review and AI-assisted bug hunting now surface findings faster than security teams can process them, and each finding still has to be reproduced by hand, a task the company said takes between 15 minutes and four hours per item.

Neo Triage attempts to reproduce every incoming finding against the live asset where it was reported. The tests run from an isolated sandbox, and ProjectDiscovery said they are designed not to damage the systems being probed.

Each check ends with a verdict such as valid, duplicate or spam, and the exact traffic from the test is sent to the reviewer as evidence. Severity is based on the impact demonstrated by the test. Neo also examines how exposed the asset is, what data sits behind it and what else an attacker could reach from it, the company said.

Findings can come from HackerOne, GitHub security advisories, security mailboxes and scanners from Qualys and Orca Security, and they land on a single board. ProjectDiscovery said any other tool with an API can also be connected.

After a finding is confirmed, Neo suggests a fix and drafts a reply to the researcher who reported it. A retest runs automatically after the change ships. An insights dashboard tracks the open backlog and service-level agreement status and grades each source on the quality of the reports it sends in.

Rishi Sharma, co-founder and chief executive of ProjectDiscovery, said he expects triage to be the biggest problem security teams face over the next six to 12 months. Most organizations already have thousands of open findings, and some have millions, he said. “The hard part now is deciding which findings matter, and a score can’t make that decision,” Sharma said. “Proof can.”

ProjectDiscovery estimated that working through a backlog of 100,000 findings by hand would take about 50,000 hours, enough to keep 25 people busy for a year. By its count, reviewing Neo’s verdicts on the same backlog would take roughly 8,300 hours.

ProjectDiscovery is a venture capital-backed startup that raised a $25 million Series A round led by CRV in 2023. Its best-known tool is Nuclei, an open-source scanner that the company says has logged more than 10 billion scans. Neo went on sale in March and became generally available in August, running on the set of tools that grew up around Nuclei.

Neo Triage is available now in every Neo tier, including the free tier. Getting started on Neo costs nothing, with monthly usage included and no time limit, and heavier users can move to Pro or Enterprise plans that operate under zero data retention, according to the company.