Resource hub
The AI Code Deluge: Are Security Teams Ready?
200 cybersecurity practitioners told us what AI-assisted coding is really doing to their teams. The short version: engineering is shipping faster than ever, and security is absorbing the impact. This report breaks down where the pressure is building, what is breaking, and what it will take to close the gap.
How We Cut LLM Costs by 59% With Prompt Caching
At ProjectDiscovery, we've been building Neo, an autonomous security testing platform that runs multi-agent, multi-step workflows, routinely executing 20-40+ LLM steps per task. Vulnerability assessments, code reviews, and security audits at scale, enabling continuous testing across the entire development lifecycle. When we launched, our LLM costs were staggering. A single complex task with Opus 4.5 could consume 60 million tokens. Then we implemented prompt caching. Here's what changed:
Can't we do this with Claude Code?
We ran the experiment so you don't have to. Join our Founding Solutions Engineer, Davis Franklin, for a live look at the execution harness behind Neo and why it's harder to replicate than it looks.
Everyone is finding vulns. The hard part is proving them.
LLMs are a genuine leap forward for vulnerability discovery. Anthropic reported 500+ zero-days from Opus 4.6 and OpenAI's Codex Security discovered 14 CVEs across projects like OpenSSH and GnuTLS. If you've experimented with LLMs for security testing, you've probably been impressed too. The practical reality for a security team deploying AI is messier than the headlines or early POC results suggest. Noise compounds fast. Anthropic brought in external security researchers to help validate the vo
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
This is Part 2 of our vibe coding security benchmark study. In Part 1, we compared how LLM-based security tools like ProjectDiscovery's Neo and Claude Code performed against traditional SAST and DAST scanners on AI-generated code. We found that LLM-based tools like Neo and Claude Code detected many high-value findings that traditional scanners missed. Between Neo and Claude Code, Neo produced more true positives and fewer false positives because it could validate hypotheses against a running app
How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code
Executive Summary Neo found a Server-Side Request Forgery (SSRF) vulnerability in Faraday, a widely used HTTP client library in the Ruby ecosystem. This is Neo’s first credited CVE discovery. Neo is ProjectDiscovery’s AI security copilot for tasks like code review and vulnerability discovery. For this finding, Neo reviewed a widely used open source dependency and, without human guidance, surfaced a subtle URL-handling edge case, validated it in runtime, and produced a clear write-up that maint
AI code review has come a long way, but it can’t catch everything
AI code review can reason about intent, but real incidents often stem from business logic flaws that only show up in runtime. Our benchmark reveals where code-only review falls short.
Continuous Pentesting with Verified Proof
See how Neo continuously combines code understanding and runtime exploitation to find business logic flaws, complex IDORs, and auth bypasses that black-box tools miss.
Scale security services without scaling manual work
Neo helps MSSPs turn pentesting, validation, and reporting into repeatable, evidence-backed delivery across every customer environment.
Try Neo at RSAC 2026
See how Neo delivers concrete proof and actionable next steps that keep security moving at engineering speed.
Announcing the ProjectDiscovery OSS Bounty Program
Democratizing Security, One Contribution at a Time Today, we're excited to announce the launch of the ProjectDiscovery OSS Bounty Program, a new initiative to reward meaningful contributions to our open-source security tools. The Vision At ProjectDiscovery, we've always believed that security should be accessible to everyone. Our tools are used by researchers, defenders, and builders worldwide. From Fortune 500 security teams to independent bug bounty hunters, from government agencies to ope
New Report: State of AppSec 2026 | Security at Engineering Speed
In 2026, most organizations aren’t shipping “applications” so much as they’re shipping continuous change; across APIs and services, infrastructure and configuration, identity and permissions, feature flags, and AI-assisted code.