Frequently Asked Questions

Nullify is an autonomous product security program — a system of AI agents that finds vulnerabilities, validates exploitability with a reproducible proof, scores impact against your business context, writes the fix, routes the PR to the right owner and drives it to merge. It replaces a sprawling toolchain of scanners and the people required to operate them.

Traditional scanners match signatures and produce alerts — the work of triaging, prioritising and fixing still lands on your team. Nullify reasons about how your application actually works, so it catches business-logic flaws signatures miss (IDOR, broken access control, priv-esc), proves exploitability, and closes the loop by shipping merge-ready fixes. It's execution, not just detection.

No. Every fix is validated against your build before a human sees it, and when CI fails Nullify reads the logs and self-refactors until the PR is merge-ready. Across our customers the merge-ready rate is 89% — developers only need to touch a Nullify fix roughly one time in ten.

Vault — Nullify's long-term memory — ingests your code, cloud, ticketing, messaging, bug bounty and documentation to build a unified ontology of your organization. Impact is scored against your real assets, data sensitivity and threat model, so a finding's severity reflects your business risk, not a generic CVSS number.

Nullify connects to your source repositories, cloud infrastructure and workflow tools with scoped, least-privilege access. It operates within your controls, and every action it takes — every token spent, every decision made — is accountable and auditable. Detailed security and compliance documentation is available on request during your evaluation.

Most work closes on its own. When a fix genuinely needs a judgment call — a risk acceptance, a breaking change, an SLA about to slip — Nullify escalates to the right person in Slack with full context and a one-click decision, then tracks it to resolution. You set the guardrails; Nullify handles the execution.

You pay for the security work Nullify actually performs — not per seat or per license tier. We scope what your program needs with you, estimate the volume of work to be done, and price against that, so cost tracks the outcomes you get.

Onboarding Nullify is like onboarding a new member of your security team. You connect its access, Vault ingests your context, and it begins finding and validating within days — no rules to write, no signatures to tune.