Open source cybersecurity company ProjectDiscovery Inc. today added Neo Triage to its Neo security testing platform to confirm which reported vulnerabilities can actually be exploited before teams begin remediation.
The new feature aims to address the triage backlog that ProjectDiscovery attributes to artificial intelligence. Scanners, AI code review, and AI-powered troubleshooting now deliver insights faster than security teams can penetrate them. Each of these results still needs to be reproduced by hand, and the company said this takes between 15 minutes and four hours each.
Neo Triage attempts to reproduce each incoming finding against the live asset it was reported on. The tests are run in an isolated sandbox and, according to ProjectDiscovery, they are designed not to damage the systems being examined.
Each check ends with a verdict such as “valid”, “duplicate” or “spam”, and the exact traffic goes to the checker as evidence. The severity is determined by the impact demonstrated by the test. Neo also examines how exposed the asset is, what data is behind it, and what else an attacker could achieve.
The insights themselves can be obtained from HackerOne Inc., GitHub security advisories, security mailboxes and scanners such as Qualys Inc. and Orca Security Ltd. and all end up on a single board. Any other tool with an application programming interface can also be connected.
Once a finding is confirmed, Neo proposes a solution and writes a response to the researcher who reported it. After the change is delivered, a new test is automatically carried out. An insights dashboard tracks open backlog and service level agreement status, and also rates each source based on the quality of their submissions.
Rishi Sharma, co-founder and CEO of ProjectDiscovery, predicts triage will be the biggest issue facing security teams in the next six to 12 months. Most organizations already have thousands of results open, he said, some even millions. “The hard part now is deciding which outcomes are important, and an assessment cannot make that decision,” Sharma said. “Proof can.”
The company estimated that manually processing a backlog of 100,000 findings would take about 50,000 hours, enough to employ 25 people for a year. Reviewing Neo’s judgments on the same backlog would take about 8,300 hours, according to the company.
ProjectDiscovery is a venture capital-backed startup that raised $25 million in a Series A round led by CRV in 2023. Its best-known tool is Nuclei, an open-source scanner that the company says has logged more than 10 billion scans. Neo, which runs on the tools based on it, went on sale in March and became generally available in August.
Neo Triage is now available at every Neo tier, including free. Neo costs nothing to get started, monthly usage is included and there are no time limits, and more demanding users can upgrade to Pro or Enterprise plans, which have no data retention.
Image: ProjectDiscovery
Support our mission to keep content open and free by interacting with theCUBE community. Join theCUBE Alumni Trust Networkwhere technology leaders connect, share information and create opportunities.
- Over 15 million viewers of theCUBE videosto spark conversations about AI, cloud, cybersecurity and more
- Over 11.4k theCUBE alumni — Connect with more than 11,400 technology and business leaders shaping the future through a unique, trusted network
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands, reaching over 15 million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is a game-changer in audience engagement, leveraging the theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of the industry conversation.
