WebinarNeoNuclei
From Nuclei to Neo: LIVE with Rishi
Nuclei changed how the industry thinks about vulnerability scanning. Neo is the next chapter. Join us on Wednesday, May 20th, at 1 PM ET as Davis sits down with Rishi in San Francisco to cover why we created Nuclei, the hard questions in security, and where the industry is going.
BlogNeoAnnouncement
Neo v1 is now available for everyone
AI adversaries now operate at machine speed. Traditional ASM tools can't keep up. Neo v1 is designed to help defenders stay ahead.
ResearchAI
Watching Agents Work: A Behavioral Audit of Offensive-Security LLM Runs
What closed and open models actually do when you tell them to hack a website Summary The cybersecurity capability of a model is currently measured by a solve rate, a percentage, and that number tells you almost nothing worth knowing. It doesn't tell you how the model behaved. It doesn't tell you what it is actually capable of, or where it is lacking, or how far it still is from doing the job end to end. And when you put an agent next to a human practitioner, the entire comparison collapses in
Vulnerability ManagementScanners
Introducing Internal Network Scanning: see your network the way an attacker inside it would
Most breaches don't begin with a zero-day but with something ordinary like a forgotten server, an unmanaged network device, a service reachable across a segment that was supposed to be isolated. Internal scanning was supposed to catch exactly that but most scanners match a host's banner and version against a CVE list and flag everything potentially affected, so the few reachable exposures sit lost among thousands that were never exploitable. That noise is expensive now that the window to respon
Community Spotlight: Rishi (@rxerium)
“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con
EventBlack HatAI Security
Black Hat 2026: Experience Neo in Action
Join ProjectDiscovery at Black Hat 2026 to experience Neo in action. Discover live demos, real workflows, and how to uncover and fix exposures at scale.
WhitepaperNeoAI Security
Build It or Buy It? An Evidence-Based Framework for AI Security Testing
LLMs can detect vulnerabilities. But can your DIY solution validate, scale, and survive a team transition? Download the whitepaper to find out when building makes sense and when it doesn't.
WebinarNeoAI Security
Should you build or buy your AI security tool?
See why building your own AI security tool is easy until the bill arrives. Join our next webinar to see where the build vs. buy math really lands.
The Vulnerability Curve Bent With the AI Curve
How CVE volume, known-exploited counts and time-to-exploit all changed shape across the LLM build-out and why defenders are now on the wrong side of the clock. In 2018 the world published about 18,000 CVEs and the average vulnerability took roughly two months to get exploited after it went public. By 2025 the world was publishing nearly 50,000 CVEs a year and the average vulnerability was being exploited before it was disclosed. Those two facts are the whole story. The number of vulnerabilitie
NeoApplication Security
Continuous PR Security Review
The security findings that end up in incident post-mortems rarely looked dangerous in the PR that introduced them. Not because anyone was careless but because there's nothing in the change that looks wrong. The code does exactly what it says but the problem is in how the app behaves once it's running. A new endpoint ships without a permission check but every other route in the file handles permissions correctly, so nothing about it stands out. Or a response comes back carrying more of a user's
NeoEngineering
How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify
Our first engineering post covered prompt caching, the infrastructure change that made long-running agentic tasks economically viable. That post assumed a multi-step, multi-agent system already existed. It did not exist on day one. When we started building Neo, the product was a single agent with a sandbox and a large toolset. Today, a typical task runs through optional planning, an Execution agent that delegates to parallel specialized subagents, and a verification loop that can re-run w
Neo
Red-Teaming Cloud Infrastructure with Neo
Most AI security tooling shipped over the last year focuses on one of two workflows, code review at PR time or zero-day research in open-source software. Models in PR pipelines now flag insecure patterns at every commit and autonomous research runs have produced more zero-days across open-source projects than the patch teams behind them can realistically triage. We've been running Neo on both of those workflows at ProjectDiscovery for a while now, surfacing zero-days in production software and t