research

// How we work

From a CVE ID to a validated fix

An advisory tells you something is wrong. Our job is everything after that: proving whether an endpoint is exposed, reducing the risk until a patch can land, and showing that both actually work before they reach a single customer machine.

–CVEs covered
–Scripts published
–In CISA KEV

// The process

Six steps for every CVE

Each step produces evidence. Nothing moves forward on assumptions.

  1. 01

    Triage

    We start with what's riskiest: actively exploited, likely to be exploited, or requested by customers.

  2. 02

    Research

    We find out which versions are affected, what makes it exploitable, and how to reduce the risk.

  3. 03

    Reproduce

    We exploit it in an isolated lab to prove the risk is real.

  4. 04

    Detect

    A read-only script that tells you if an endpoint is exposed.

  5. 05

    Mitigate

    A script that applies the vendor's workaround, then confirms the risk is gone.

  6. 06

    Validate & release

    Automated tests and human review, then published to vRx.

// Testing

What a script has to survive before release

Scripts run unattended on real machines, so we test them on multiple operating systems against every outcome they can report before they ship.

example · detection · vulnerable scenario

[10:00:00] Product: examplesvc 2.4.1 (package)
[10:00:00] Fixed in: 2.4.3 (or distro backport 2.4.1-1.2)
[10:00:01] Vulnerable module loaded → yes
[10:00:01] Workaround applied → no
RESULT=CVE-YYYY-NNNNN|VULNERABLE|TRUE

  • Accurate detection

    Flags exposed systems, ignores safe ones.

  • No false positives

    Silent on clean systems.

  • The exploit stops working

    We re-run it after mitigation. It must fail.

  • Reversible

    Every change can be rolled back.

  • Declared side effects

    No surprises: any impact is stated up front.

  • Honest verdicts

    It never reports a success it can't prove.

// VulnGPT

VulnGPT: Our internal AI research platform

Our team's AI platform. Give it a CVE and specialized agents research, reproduce and script it — then an automated Judge decides if it's good enough.

  1. CollectorCVE data
  2. ResearchAdvisories & patches
  3. Lab BuilderIsolated lab
  4. ExploitProof, in the lab
  5. DetectionDetection script
  6. RemediationMitigation script
  7. JudgePass / fail rubric
  8. ReportingReport & evidence

Evidence at every stage

Every decision traces back to what happened in the lab.

A Judge, not a guess

A fixed rubric, not a language model, decides. One failed check and it goes back.

Humans in control

Researchers approve every exploit run and review every script.

// The team

The people behind the research

Nahuel Benitez

Nahuel Benitez

Research Team Lead

Leonardo Granda

Leonardo Granda

Head of Solutions Architect & Enablement, Americas

Is there a CVE keeping you up at night?

Tell us. Requests from the field shape what we research next.

Request a CVE Browse coverage