ProjectDiscovery Introduces Neo Triage to Streamline Vulnerability Assessment
Open-source cybersecurity company ProjectDiscovery Inc. has announced the addition of Neo Triage to its Neo security testing platform. This new feature aims to confirm the exploitability of reported vulnerabilities before teams initiate remediation efforts.
ProjectDiscovery identifies the triage backlog as a significant challenge, attributing its growth to advancements in artificial intelligence. Current tools such as scanners, AI-driven code reviews, and AI-assisted bug detection generate findings at a pace that exceeds the capacity of security teams to address them. Each finding requires manual reproduction, a process that the company estimates can take between 15 minutes to four hours per item.
Functionality of Neo Triage
Neo Triage seeks to automate the verification of incoming findings against the live assets they pertain to. These tests are conducted within an isolated sandbox environment, ensuring that they do not compromise the integrity of the systems under examination.
Each analysis concludes with a classification, such as valid, duplicate, or spam, and provides the reviewer with corresponding traffic data as evidence. The severity of the findings is determined based on the impact demonstrated during the testing. Additionally, Neo assesses the asset’s exposure, the sensitivity of the data it contains, and the potential access points an attacker could exploit.
Findings can originate from various sources, including HackerOne Inc., GitHub security advisories, security mailboxes, and scanners such as Qualys Inc. and Orca Security Ltd. All findings are aggregated onto a unified board, allowing for integration with any tool that possesses an application programming interface (API).
Once a finding has been confirmed, Neo recommends potential fixes and prepares a response to the researcher responsible for the report. A retesting procedure is automatically triggered once changes are implemented. An insights dashboard monitors the backlog of open items and service-level agreement statuses while also evaluating the quality of submissions from different sources.
Industry Insights
Rishi Sharma, co-founder and CEO of ProjectDiscovery, predicts that triage will emerge as the most pressing issue for security teams over the next six to twelve months. He noted that many organizations currently face open findings in the thousands, with some reaching millions. “The difficult part is determining which findings are significant, and a numerical score cannot make that distinction,” Sharma stated. “Evidence can.”
The company estimates that manually addressing a backlog of 100,000 findings would require about 50,000 hours, equivalent to the workload of 25 personnel over a year. In contrast, reviewing Neo’s assessments for the same backlog would take approximately 8,300 hours, according to the company’s calculations.
ProjectDiscovery’s Growth
ProjectDiscovery, a venture capital-supported startup, secured $25 million in a Series A funding round led by CRV in 2023. The company’s flagship tool, Nuclei, is an open-source scanner that has conducted over 10 billion scans. Neo, which is built on tools developed alongside Nuclei, was launched in March and achieved general availability in August.
Availability and Pricing
Neo Triage is now accessible across all tiers of the Neo platform, including the free tier. Users can engage with Neo at no cost initially, benefitting from monthly usage without a time limitation. For more extensive usage, options are available to upgrade to Pro or Enterprise plans that operate with no data retention policy.