Automated vulnerability triage
Classification and severity prediction so humans review judgement calls rather than inventory.
AI assistance
Applied where the hours go
AI that takes the admin, not the judgement
Classification, duplicate detection, remediation guidance and report drafting are applied to the work that does not scale by hiring. Contractual and legal decisions stay with your team.
AI triage, duplicate intelligence and automated payouts are Professional-tier. Threat modelling assistance and advanced vetting are Enterprise-tier.
Platform viewLive
- Recon agentqueued
- Exploit agentrunning
- Validatorvalidated
- Reportready
What automated assistance changes
Applied to triage, it changes both the cost of running a program and how quickly findings reach engineering.
- Reward integrity
- Less duplication
- Reviewer time
- Faster triage
- Input quality
- Better submissions
- Remediation
- Faster fixes
Likely repeats are flagged at submission time rather than after review effort is spent.
Reviewers start from a classification proposal instead of an empty form.
Guidance for researchers before they hit send, so more reports arrive complete.
Guidance is written for the language and framework in use, with a testing step attached.
Capabilities
Where AI is applied
Each capability is bounded: what the system proposes, and what a human still decides.
Duplicate intelligence
Semantic similarity detection, including across programs, surfaced before effort is spent.
Remediation guidance
Technology-specific guidance with before/after examples for Node.js, Python, Java, PHP, Go and common frameworks.
Report generation
Structured report drafts assembled from raw findings and evidence, reviewed before publication.
Risk scoring
Model-based scoring to support prioritisation by realistic exploitability.
Hunter finding assistant
Real-time help for researchers to structure a submission and attach the evidence triage will ask for.
Threat modelling assistance
Support for structured threat modelling sessions and their output.
Policy generation
Drafts of program and disclosure policy aligned to your program, for legal review.
Prioritisation support
Signals that help decide what to fix first when volume exceeds capacity.
What AI does not do
The boundaries matter more than the capability list, especially for programs with contractual obligations.
- It does not auto-close reports on similarity alone — a human makes the attribution decision.
- It does not set rewards; pricing follows the program’s severity model and the reviewer’s decision.
- It does not replace legal review of disclosure policy.
- It does not provide tax or compliance advice on payouts.
- It does not publish anything: drafted content requires human approval before it leaves the platform.
- It does not test your systems — that is the crowd, the experts or AXUMIS, depending on the engagement.
Operating notes
Practical detail for teams evaluating automated assistance.
- Availability
- AI triage, duplicate intelligence and automated payouts are Professional-tier; threat modelling assistance is Enterprise-tier.
- Review model
- Human-in-the-loop by default: the system proposes, a person decides and signs off.
- Evidence
- Guidance and drafts are attached to the finding record, so decisions stay explainable.
- Duplicates
- Cross-program correlation applies within your organisation, not across customers.
- Researcher side
- Assistance improves submission completeness without exposing program internals.
Documentation
AI assistance in full
AI assistance
Where automation is applied, and the limits of each capability.
Read the docDuplicate intelligence
How semantic duplication is detected and scored.
Read the docTriage pipeline
The workflow these capabilities feed into.
Read the docCommon questions
AI questions we hear most
Will an AI close our researchers’ reports?
No. Automated similarity detection flags a likely duplicate; the merge, attribution and reward decisions remain human and are recorded with a rationale.
Is our data used to train models?
Vulnerability data belongs to the customer and is not used to train models for other customers. Cross-program correlation is scoped to programs under the same organisation.
How accurate is the severity prediction?
It is presented as a proposal, and reviewers confirm or override it. Overrides are retained as feedback, and the program’s published severity bands remain the source of truth for rewards.
Do we need AI to run a program?
No. Everything works without it — automation changes how much volume you can absorb, not whether the program functions.
See where automation actually saves your team time.
We will show the triage and duplicate flow on real report volume, including where a human decision is still required.