Blog

Exploit Validation: a finding is a guess, a proven exploit is a fact

Exploit Validation: Proof, Not Guesses

June 26, 2026

A scanner finding is a guess. Nullify proves it: triaging down to what is real and reachable, then generating and running a reproducible exploit against a live target, with the evidence and a reproduction you can re-run yourself.

Trust Issues: validating automated vulnerability repair

Trust Issues: Can We Actually Validate Automated Vulnerability Repair?

Omri Ram & Tim Thacker

June 18, 2026

You cannot tell an automated vulnerability repair worked unless you prove two things at once: the vulnerability is genuinely closed, and the program still works. Here is why the public AVR benchmarks cannot measure that, and how we built one that can.

A Task Is Not a System — an agent writes one PR; a program runs the whole loop, on every repo

DIY AI Product Security: Buy vs Build - A Task Is Not a System

Bryan Taylor

Prompting an agent to fix a vulnerability is a task, running a Product Security or Application Security program across hundreds of repos (or more) is a system, and the gap between them is the entire product.

Death by False Positives — how false positives broke the trust between security and engineering

Death by False Positives: How AppSec & ProdSec Lost The Developers

Bryan Taylor

June 4, 2026

Cyber didn't lose developers to laziness. It lost them to false positives. We'll show you the proof is in the data, and the way to rebuild the bridge of trust between cyber <> dev.

The Missing Layer in AI Security: Execution

Shan Kulkarni

April 9, 2026

We are asked all the time about new model releases and security code review features from the big AI labs. This blog explains how Nullify is better together with these advancements to maximise the value they create for our customers.