Blog

October 22, 2026

PHP2Shell hit PHP servers overnight. We checked 3,700 repos past the lockfile and had fixes ready for 19 vulnerable images by morning.

Most recent posts

Illustration for the playbook on getting developers to fix security vulnerabilities

How to Get Developers to Fix Security Vulnerabilities: A Playbook Built on Merge Rate

How to get developers to fix security vulnerabilities: track merge rate, send fewer proven findings, deliver passing PRs, and escalate stalls before SLA.

Illustration for the explainer on mean time to remediate in security

Mean Time to Remediate (MTTR) in Security: Definition, Formula, and Examples

Mean time to remediate (MTTR) is the average time from finding a vulnerability to fixing it. Learn the formula, a worked example, and what a good MTTR is.

Illustration for the guide to setting vulnerability remediation SLAs

Vulnerability Remediation SLAs: How to Set Them by Severity and Risk

How to set vulnerability remediation SLAs by severity and real risk: example timelines, what PCI DSS and CISA require, exceptions, and how to measure them.

Illustration for the comparison of CVSS, EPSS and CISA KEV

CVSS vs EPSS vs CISA KEV: Which One Should Rank Your Vulnerability Backlog?

CVSS vs EPSS vs KEV compared: what each score measures, where each one fails, and a simple rule for combining them to rank your vulnerability backlog.

Research

Experiments and findings from the Nullify team on triage, reachability and AI-driven exploitation.

Let the Cheap Model Look

August 21, 2026

Replacing a one-shot frontier model false-positive screen with a tool-using open-weight agent.

Reachability Triage That Scales Without Headcount

June 26, 2026

Every unverifiable reachability call has a bill attached, and someone always pays it. When a triage system asserts "this vulnerable function is reachable" with no evidence you can inspect, a human…

Trust Issues: Can We Actually Validate Automated Vulnerability Repair?

Omri Ram and Tim Thacker

June 18, 2026

You cannot tell an automated vulnerability repair worked unless you prove two things at once: the vulnerability is genuinely closed, and the program still works. Here is why the public AVR benchmarks cannot measure that, and how we built one that can.

Per-CVE Reachability: Doing the Triage Without the Headcount

June 16, 2026

Attackers have stopped needing headcount to scale capability. Cheap, capable open-weight models let a small crew generate, adapt, and fire exploits at a rate that used to require a team — so a…

All Research posts →

Product

How Nullify finds, validates and fixes vulnerabilities, one capability at a time.

A lone figure in a bowler hat climbs faceted teal stone stairs toward a glowing light, the Nullify illustration style

How to Create Merge-Ready AI Code Fixes That Engineers Trust

September 30, 2026

What an AI autofix PR needs before a developer merges it untouched: a finding worth fixing, a minimal diff, proof, the right reviewer and green CI.

Exploitability Is Only Half the Triage Decision

July 29, 2026

Exploitability is only half of vulnerability triage. See how Vault grounds impact scoring in your organization’s business context, so the findings that matter most move first.

Automating the Last Mile: Escalating Fixes Before They Breach SLA

July 16, 2026

A fix PR that nobody reviews is a vulnerability that nobody closed. We now follow fix PRs all the way to the merge: resolving who owns the code, checking whether they have capacity to review it, and escalating on the schedule your own runbooks define.

Dependency Cooldowns: Catching Supply-Chain Attacks Before a CVE Exists

Catching Supply-Chain Attacks Before a CVE Exists: Pins, Cooldowns, and Threat Investigations

July 14, 2026

A supply-chain worm lives and dies before a CVE is ever filed. We built a five-part system for that gap: unpinned-dependency detection with autofix PRs, dependency cooldowns enforced by us and by your own tooling, a PR gate for too-fresh versions, and AI threat investigations that sweep every repo and CI pipeline to answer "are we affected, and did it run?" in hours.

All Product posts →

Industry Insights

Perspectives on running a product security program as AI changes how code is written and attacked.

How to Get Developers to Fix Security Vulnerabilities: A Playbook Built on Merge Rate

How to get developers to fix security vulnerabilities: track merge rate, send fewer proven findings, deliver passing PRs, and escalate stalls before SLA.

Mean Time to Remediate (MTTR) in Security: Definition, Formula, and Examples

Mean time to remediate (MTTR) is the average time from finding a vulnerability to fixing it. Learn the formula, a worked example, and what a good MTTR is.

Vulnerability Remediation SLAs: How to Set Them by Severity and Risk

How to set vulnerability remediation SLAs by severity and real risk: example timelines, what PCI DSS and CISA require, exceptions, and how to measure them.

CVSS vs EPSS vs CISA KEV: Which One Should Rank Your Vulnerability Backlog?