ProjectDiscovery has added Neo Triage to its Neo security platform, using tests against live assets to check whether reported vulnerabilities can actually be exploited. The practical promise is a more evidence-led way to sort a security backlog, where a score alone may not tell teams what deserves attention first.
Watch Desk analysis
What happened
Neo Triage attempts to reproduce each finding in an isolated sandbox, then returns a verdict such as valid, duplicate or spam. ProjectDiscovery says reviewers receive the test traffic as evidence, and that severity reflects the impact demonstrated. The company says the tests are designed not to damage the systems being probed.
The feature can collect findings from sources including HackerOne, GitHub security advisories, security mailboxes and scanners, with other API-connected tools also supported. Once a finding is confirmed, Neo can suggest a fix, draft a response to the reporter and run a retest after the change ships. SiliconANGLE reports that Neo Triage is available now across Neo tiers, including the free tier.
Why it matters
Security teams can be swamped by findings that still need manual reproduction. ProjectDiscovery estimates that checking 100,000 findings by hand would take about 50,000 hours; it estimates reviewing Neo’s verdicts for the same backlog at roughly 8,300 hours. Those are the company’s estimates, but they show the scale of the time-saving claim.
The useful shift is from asking an automated system to rank a pile of alerts to asking it to produce evidence that a finding is exploitable. That could help teams spend scarce review time on better-supported problems. It also makes the quality of the test and the evidence crucial: a confident verdict is only useful if the reproduction is sound.
Our read
This is a substantial security workflow, not just another dashboard with an AI sticker applied. Teams should judge it by how often its verdicts hold up against human review, and whether the evidence makes prioritisation easier. ProjectDiscovery’s account makes the case for trying it; it does not establish how accurately the product performs in practice.
What to watch
- How often Neo’s exploitation verdicts are confirmed by security teams.
- Whether the sandbox tests behave safely across different kinds of live assets.
- Whether teams report less triage work without missing serious vulnerabilities.
Discussion spark: Would you trust automated proof of exploitability to set your security team’s priorities, or should a person validate every finding first?
Sources and evidence
- ProjectDiscovery adds Neo Triage to confirm which vulnerabilities are exploitable – SiliconANGLE (26 October 2026, 14:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.