Insights on AI-powered product security: vulnerability triage, false-positive reduction, autonomous remediation, and closing the patch gap — from the team at Nullify.
Exploitability is only half of vulnerability triage. See how Vault grounds impact scoring in your organisation’s business context, so the findings that matter most move first.
A fix PR that nobody reviews is a vulnerability that nobody closed. We now follow fix PRs all the way to the merge: resolving who owns the code, checking whether they have capacity to review it, and escalating on the schedule your own runbooks define.
You cannot tell an automated vulnerability repair worked unless you prove two things at once: the vulnerability is genuinely closed, and the program still works. Here is why the public AVR benchmarks cannot measure that, and how we built one that can.
A scanner finding is a guess. Nullify proves it: triaging down to what is real and reachable, then generating and running a reproducible exploit against a live target, with the evidence and a reproduction you can re-run yourself.
Discovery is effectively infinite now. Cheap, capable open-weight models have collapsed the cost of generating findings: a self-hostable model like GLM-5.2 can now surface plausible vulnerability…
A security program is a headcount problem wearing a tooling costume. The scanner is cheap; the humans who route, triage, and chase every finding are not. So the real question for any AppSec platform…
Every unverifiable reachability call has a bill attached, and someone always pays it. When a triage system asserts "this vulnerable function is reachable" with no evidence you can inspect, a human…
A supply-chain worm lives and dies before a CVE is ever filed. We built a five-part system for that gap: unpinned-dependency detection with autofix PRs, dependency cooldowns enforced by us and by your own tooling, a PR gate for too-fresh versions, and AI threat investigations that sweep every repo and CI pipeline to answer "are we affected, and did it run?" in hours.
Nullify's whole premise is that security work — finding, triaging, program-managing, and fixing exposure — can run end-to-end, cheaply, on AI that stays controlled and measurable, so a team's output…
Attackers have stopped needing headcount to scale capability. Cheap, capable open-weight models let a small crew generate, adapt, and fire exploits at a rate that used to require a team — so a…
The goal every security leader is actually chasing is simple to state and brutal to reach: get security work done end to end — assigned, tracked, verified, closed — efficiently, with automation you…
Nullify's thesis is that security work — finding, triaging, program-managing, and fixing exposure — should run end to end on AI that stays controlled and measurable, so a program's output stops…
Nullify exists to automate security work end to end — find, triage, plan, fix — and to do it with AI you can actually control and measure, so a team's security outcomes stop scaling with its…
Every security leader is being asked the same question this year: prove the program is working. The headcount to answer it is flat, the attack surface is not, and the number most teams reach for —…
Every high-CVSS finding a scanner hands you demands the same thing: someone's attention. If you've pointed an AI agent at the queue, it demands the same token spend too. And most of that attention…
Authorization flaws — IDOR, broken access control, tenant isolation gaps — used to be expensive to find at scale. They resist signature scanners because the bug isn't in the code shape; it's in the…
We build attack-surface monitoring for a living, and we still had zombie subdomains sitting in Google's index. An internal infrastructure audit turned up our own 2024 seed-era staging site, five…
Ask a good pentester which class of vulnerability does the most damage, and the answer comes back with unsettling regularity: authorization bugs. Broken object-level authorization (BOLA), broken…
Attackers have already figured out that capability no longer scales with headcount. The tooling to run the kind of simultaneous, multi-target campaign that used to take a whole crew is now…
Prompting an agent to fix a vulnerability is a task, running a Product Security or Application Security program across hundreds of repos (or more) is a system, and the gap between them is the entire product.
Cyber didn't lose developers to laziness. It lost them to false positives. We'll show you the proof is in the data, and the way to rebuild the bridge of trust between cyber <> dev.
We are asked all the time about new model releases and security code review features from the big AI labs. This blog explains how Nullify is better together with these advancements to maximise the value they create for our customers.
