ProjectDiscovery, the company behind the open-source Nuclei scanner, has made Neo Triage generally available. The pitch is blunt. Instead of ranking a vulnerability backlog by score, Neo tries to reproduce each finding against the live asset it was reported on and comes back with a verdict and the traffic to back it up.
It’s included in every Neo tier, the free community tier among them. That matters more than the feature list. Triage is the expensive, boring part of vulnerability management, and ProjectDiscovery is giving it away to pull teams onto its platform.
What Neo Triage actually does
Findings come in from HackerOne, GitHub security advisories, a security mailbox, scanners such as Wiz, Qualys and Orca, or any tool with an API. Neo loads context about the target asset (its apps and APIs, docs, network and identity setup, earlier findings), writes down what the reporter claimed, rewrites the proof of concept as its own script and runs it from an isolated sandbox.
Each finding ends up labeled valid, duplicate, needs more information, informative, not applicable or spam. The requests and responses come attached. Severity is set from the impact Neo could show, plus what the asset holds and what else an attacker could reach from it. Once a fix ships, Neo reruns the original reproduction and marks it fixed, not fixed or blocked.
The company’s own examples show both directions. A server-side request forgery a researcher rated High got followed through to the cloud metadata service, where Neo read role credentials that could reach customer uploads. It came back Critical. A reported 9.8 that didn’t reproduce on anything the customer runs got closed, with the failed attempts kept as evidence.
Running exploit code against production is the obvious worry. ProjectDiscovery says reporter code is never run as submitted, the sandbox shell holds no Neo credentials, and a runtime classifier checks every command before it executes, blocking destructive actions, credential exposure and data sent to unapproved destinations. Teams can deny, rewrite or require approval for commands at the org, repo, user or task level. Enterprises can run the whole stack on-prem or in their own cloud account. Those are vendor claims, and security teams will want to test them before pointing Neo at anything that pays the bills.
The case against static scores
ProjectDiscovery’s argument is that traditional triage is a weighted formula over CVSS, EPSS probability, published exploits, version matches and asset tags, and none of those inputs come from the running system. A score can’t tell you whether the vulnerable code path is reachable or whether a WAF eats the request. The company calls a risk score “a likelihood, not a test.”
That’s a fair hit on CVSS, which rates a flaw in the abstract. It’s a bit harder on EPSS and CISA’s Known Exploited Vulnerabilities catalog, which exist to tell defenders what attackers are using in the wild. Those still say nothing about your own deployment, though. And they don’t touch the flood of bug bounty and scanner reports that never map to a CVE at all.
We made a similar point this morning: across Texas hospitals, 316 possible vulnerabilities narrowed to 9 confirmed KEV flaws. Finding issues is the easy part now. Sorting the real ones from the noise is where the hours go.
The numbers and the business
ProjectDiscovery puts manual triage at 15 minutes to four hours per finding. On a 100,000-finding backlog it estimates about 50,000 hours of hand review, roughly 25 people for a year, against about 8,300 hours of reviewing Neo’s verdicts. That’s the company’s math, not an independent test, and it assumes the verdicts are good enough to sign off on quickly.
Neo launched in March and went generally available in August with pay-as-you-go pricing. The company raised a $25 million Series A led by CRV in 2023, says Nuclei has logged more than 10 billion scans, and won the RSAC Innovation Sandbox in 2025. CEO Rishi Sharma expects triage to be the biggest problem security teams face over the next six to 12 months, as AI agents and researchers pointing models at bug bounty scopes push report volume up.
“The hard part now is deciding which findings matter, and a score can’t make that decision,” Sharma said. “Proof can.”
What to watch is the false negative rate. A tool that closes a real bug as not applicable, with tidy evidence attached, is worse than a long queue. Nobody has published that number yet.