Building an Autonomous Security Framework: Inside ProjectDiscovery’s Nuclei and Neo + Video

By /

Listen to this Post

Featured Image

Introduction:

Vulnerability scanners often drown teams in false positives and version-check noise, wasting time on issues attackers will never exploit. ProjectDiscovery—the team behind the world’s most widely used open-source vulnerability scanner Nuclei—tackles this by shifting from guesswork to evidence‑based, runtime exploitability testing. The company’s new AI‑powered platform, Neo, takes this further by automating entire security workflows, from code review to proof‑of‑exploit delivery. This article extracts technical workflows, configuration commands, and training insights from ProjectDiscovery’s ecosystem to show how security teams can cut false positives at scale and operationalise autonomous testing.

Learning Objectives:

  • Deploy Nuclei for template‑based vulnerability scanning with near‑zero false positives.
  • Generate custom detection templates using YAML and AI‑assisted editing.
  • Understand how Neo automates multi‑step exploit verification and delivers pentest‑grade evidence.
  • Integrate Nuclei into CI/CD pipelines for continuous, exploitability‑focused security testing.
  • Differentiate between version‑based detection and runtime exploitability validation.
  1. Setting Up Nuclei: The Foundation of Evidence‑Based Scanning

Nuclei is a fast, template‑driven vulnerability scanner written in Go. Its YAML‑based templates encode precise exploitability tests that simulate real‑world attack steps—unlike traditional scanners that rely on software version banners. Install Nuclei on any Linux, macOS, or Windows system using the Go toolchain.

Step‑by‑step installation and first scan:

  1. Install Go (≥1.21) – Download from go.dev or use your package manager.
  2. Install Nuclei – Run the following command in your terminal: 
    go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
  3. Verify installation – Check version and update templates: 
    nuclei -version
nuclei -update-templates
  4. Run your first scan – Test a single target with all (or a specific set of) templates: 
    nuclei -u https://example.com -t ~/nuclei-templates/http/

    For Windows PowerShell, use `$env:USERPROFILE` instead of ~. The `-t` flag points to template directories; you can run a single template with -t ~/nuclei-templates/http/misconfiguration/robots-txt.yaml.

What this does:

Nuclei sends crafted requests to the target, matches responses against matchers defined in the template, and outputs findings only if the exploit path succeeds. The output includes the template ID, severity, and a precise request‑response pair that proves exploitability—drastically reducing false positives compared to version‑based checks.

  1. Writing Custom YAML Templates: From Detection to Exploit Verification

Every Nuclei template is a self‑contained YAML file with three main sections: info, `requests` (or protocol‑specific blocks), and matchers. The template encodes not just what to look for, but how to safely trigger the vulnerability.

Step‑by‑step guide to building a custom HTTP template:

  1. Create a new YAML file – For example, api-idor.yaml.

2. Define basic metadata:

id: api-idor-detection
info:
name: Insecure Direct Object Reference in API
author: your_name
severity: high
tags: api,idor

3. Add the HTTP request – Include variables and dynamic extraction:

http:
- method: GET
path:
- "{{BaseURL}}/api/user/{{user_id}}"
extractors:
- type: regex
name: user_id_range
regex:
- "[0-9]{1,5}"
internal: true
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "email"
- "role"

4. Test the template:

nuclei -target https://target.com -t api-idor.yaml -debug

5. Leverage AI assistance – Use the built‑in AI template generator inside the ProjectDiscovery Cloud Platform (PDCP) editor by describing your detection need in plain language.

What this does:

The template above tries to fetch a user resource with a numeric ID; if the server returns a 200 status and contains sensitive fields like email, Nuclei flags an IDOR. The `extractors` section can pull dynamic values (e.g., CSRF tokens) to reuse in multi‑step chains, making it possible to test complex business logic flaws.

  1. Reducing False Positives at Scale: Runtime Validation and Flow Engines

Traditional scanners often flag every system that is below a patch level, drowning teams in noise. Nuclei’s v3 flow engine allows you to chain templates, perform conditional execution, and validate exploit preconditions before reporting a finding.

Step‑by‑step technique for multi‑step exploit verification:

  1. Use the flow syntax – Create a `.yaml` file that defines a sequence: 
    id: auth-bypass-flow
flow:</li>
</ol>

- template: http/login-fingerprint
matchers:
- type: word
words: ["Login successful"]
extractors:
- type: regex
name: token
regex: ["session=([a-f0-9]+)"]
- template: http/privilege-check
variables:
session_token: "{{token}}"

    2. Add exploitability evidence – Each matcher must prove the exploit actually worked, for example by requesting a resource that only returns sensitive data after a successful bypass.

    3. Run with the flow flag:

    nuclei -u https://target.com -flow auth-bypass-flow.yaml

    4. Integrate with PDCP – Connect your local Nuclei scans to the cloud platform to visualise findings, manage false‑positive reviews, and enable real‑time autoscan of trending vulnerabilities.

    What this does:

    The flow engine executes templates in order, passing extracted values (like tokens) between steps. A vulnerability is reported only if all stages succeed—exactly as an attacker would need. This eliminates most false positives by verifying exploitability in your actual environment, not just matching a version string.

    1. From CLI to DevOps: Embedding Nuclei in CI/CD Pipelines

    To catch regressions early, security tests must run automatically on every code change. Nuclei integrates seamlessly into GitHub Actions, GitLab CI, Jenkins, and other DevOps tools.

    Step‑by‑step GitHub Actions integration:

    1. Add a workflow file (`.github/workflows/nuclei-scan.yml`):

    name: Nuclei Security Scan
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install Nuclei
run: |
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
nuclei -update-templates
- name: Run targeted scan on staging
run: nuclei -u ${{ secrets.STAGING_URL }} -severity critical,high -o results.txt
- name: Upload findings
uses: actions/upload-artifact@v4
with:
name: nuclei-results
path: results.txt

    2. Run only relevant templates – Use tags (-tags sqli,xss) or a custom template directory to avoid unnecessary checks.
    3. Fail the pipeline on critical findings – Add `-exit-on-critical` to make the job exit with a non‑zero code, blocking the merge until the issue is fixed.

    What this does:

    Every pull request triggers a lightweight scan that checks only high‑severity issues against your staging environment. The result is a continuous, exploitability‑focused regression test that prevents security flaws from reaching production. You can also integrate with Jira or Slack to automatically create tickets when new vulnerabilities are found.

    1. Meet Neo: The AI Security Engineer for Autonomous Testing

    While Nuclei automates template‑based scanning, Neo is a cloud‑based AI agent that autonomously performs end‑to‑end penetration tests, reviews code, and manages vulnerability backlogs. Neo doesn’t just flag potential issues—it builds working exploits, captures evidence, and closes the loop with verified fixes.

    Step‑by‑step Neo workflow for a new application:

    1. Point Neo at your environment – Provide design documents, PRs, or staging endpoints. Neo automatically builds a threat model.
    2. Let Neo run autonomous tests – It deploys the application in an isolated sandbox, authenticates across roles, and chains multiple attack steps (e.g., privilege escalation → IDOR → data exfiltration).
    3. Review pentest‑grade evidence – Neo returns a clear write‑up for each finding, including OAST callbacks, confirmed file reads, and even a proof‑of‑concept script.
    4. Automate fix verification – When a developer commits a fix, Neo retests automatically and updates the ticket.

    Real‑world example:

    In a benchmark against leading tools, Neo confirmed 66 exploitable vulnerabilities across three full‑stack AI‑generated applications—20% more than the next best tool—including an arbitrary refund vulnerability and systemic password hash exposure. Neo also discovered 22 confirmed CVEs across 13 open‑source projects by autonomously reviewing codebases and validating exploits.

    What this does:

    Neo handles the entire vulnerability management lifecycle: from initial discovery and triage to evidence collection and remediation validation. This cuts the time between finding a flaw and fixing it from weeks to hours, all while maintaining a false‑positive rate of only 10–20%—much lower than manual LLM‑based approaches.

    What Undercode Say:

    • Shift from version checking to exploitability verification. Traditional scanners waste resources on “maybe” findings; Nuclei’s template‑driven approach proves whether a vulnerability is actually exploitable in your environment, reducing noise and improving remediation efficiency.
    • Autonomous security agents are the next frontier. Neo’s ability to chain multi‑step attack logic, generate its own tests, and deliver pentest‑grade evidence shows that AI can now perform complex, long‑running security workflows that previously required senior engineers. This will reshape how teams operationalise DevSecOps.

    Analysis:

    The key insight from ProjectDiscovery’s work is that security tools must shift from scanning to testing. Nuclei’s YAML templates encode real attacker behaviour, not just version checks. Neo extends this philosophy by automating the entire testing lifecycle, including business logic flaws that traditional DAST scanners cannot handle (e.g., IDORs requiring multiple authenticated requests). However, implementing these tools effectively requires a cultural shift: security teams must trust automated exploit validation and integrate findings directly into developer workflows. The benchmark data is compelling—Neo found vulnerabilities that no other tool caught—but organisations should start with Nuclei to build foundational template expertise before adopting full AI autonomy. The future of application security is continuous, evidence‑backed, and agent‑driven; ProjectDiscovery provides a clear, practical path forward.

    Prediction:

    Within two years, most enterprise security teams will adopt AI‑powered agents like Neo as their primary penetration testing resource, relegating traditional scanners to legacy compliance checks. The combination of autonomous multi‑step reasoning, sandboxed runtime validation, and CI/CD integration will make annual pentests obsolete. The bottleneck will shift from finding vulnerabilities to fixing them faster—forcing development teams to adopt real‑time remediations and verifiable patch cycles. ProjectDiscovery’s open‑source foundation gives it a unique advantage, as the community‑driven template ecosystem will continue to fuel both Nuclei and Neo’s detection capabilities. Ultimately, the “zero false positive” goal will become the industry standard, not an aspiration.

    ▶️ Related Video (88% Match):

    🎯Let’s Practice For Free:

    IT/Security Reporter URL:

    Reported By: Https: – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

    💬 Whatsapp | 💬 Telegram

    📢 Follow UndercodeTesting & Stay Tuned:

    𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: