# Resource hub ## Neo v. DIY: The gap between a single finding and a mature security program In our latest webinar, our Founding Solutions Engineer, Davis Franklin, addressed the massive gap between finding a vulnerability with an LLM and running a mature security program. That gap is what Neo is built to close. With the release of Opus 4.6 and the announcement of Mythos, the question we hear constantly has gotten louder: Can I just build this with Claude Code? The short answer is yes. You can spin up a working PoC in about half an hour, find a real vulnerability, and feel genuinely confident in your findings. [Watch the Webinar](https://projectdiscovery.io/blog/neo-vs-diy) ## The AI Code Deluge: Are Security Teams Ready? 200 cybersecurity practitioners told us what AI-assisted coding is really doing to their teams. The short version: engineering is shipping faster than ever, and security is absorbing the impact. This report breaks down where the pressure is building, what is breaking, and what it will take to close the gap. [Read the Report](https://projectdiscovery.io/research/ai-coding-impact-report) ## How We Cut LLM Costs by 59% With Prompt Caching At ProjectDiscovery, we've been building Neo, an autonomous security testing platform that runs multi-agent, multi-step workflows, routinely executing 20-40+ LLM steps per task. Vulnerability assessments, code reviews, and security audits at scale, enabling continuous testing across the entire development lifecycle. When we launched, our LLM costs were staggering. A single complex task with Opus 4.5 could consume 60 million tokens. Then we implemented prompt caching. Here's what changed: [Read More](https://projectdiscovery.io/blog/how-we-cut-llm-cost-with-prompt-caching) ## Can't we do this with Claude Code? We ran the experiment so you don't have to. Join our Founding Solutions Engineer, Davis Franklin, for a live look at the execution harness behind Neo and why it's harder to replicate than it looks. [Watch the Webinar](https://projectdiscovery.io/webinars/neo-vs-claude-code) ## Everyone is finding vulns. The hard part is proving them. LLMs are a genuine leap forward for vulnerability discovery. Anthropic reported 500+ zero-days from Opus 4.6 and OpenAI's Codex Security discovered 14 CVEs across projects like OpenSSH and GnuTLS. If you've experimented with LLMs for security testing, you've probably been impressed too. The practical reality for a security team deploying AI is messier than the headlines or early POC results suggest. Noise compounds fast. Anthropic brought in external security researchers to help validate the volume of findings. [Read More](https://projectdiscovery.io/blog/everyone-is-finding-vulns-the-hard-part-is-proving-them) ## Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught This is Part 2 of our vibe coding security benchmark study. In Part 1, we compared how LLM-based security tools like ProjectDiscovery's Neo and Claude Code performed against traditional SAST and DAST scanners on AI-generated code. We found that LLM-based tools like Neo and Claude Code detected many high-value findings that traditional scanners missed. Between Neo and Claude Code, Neo produced more true positives and fewer false positives because it could validate hypotheses against a running app. [Read More](https://projectdiscovery.io/blog/inside-the-benchmark-pp-architectures-finding-walkthroughs-and-what-each-scanner-actually-caught) ## How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code ### Executive Summary Neo found a Server-Side Request Forgery (SSRF) vulnerability in Faraday, a widely used HTTP client library in the Ruby ecosystem. This is Neo’s first credited CVE discovery. Neo is ProjectDiscovery’s AI security copilot for tasks like code review and vulnerability discovery. For this finding, Neo reviewed a widely used open-source dependency and, without human guidance, surfaced a subtle URL-handling edge case, validated it in runtime, and produced a clear write-up that maintained the necessary documentation. [Read More](https://projectdiscovery.io/blog/how-neo-found-an-ssrf-vulnerability-in-faraday-and-why-it-matters-for-every-team-that-ships-code) ## AI code review has come a long way, but it can’t catch everything AI code review can reason about intent, but real incidents often stem from business logic flaws that only show up in runtime. Our benchmark reveals where code-only review falls short. [Read More](https://projectdiscovery.io/blog/ai-code-review-vs-neo) ## Continuous Pentesting with Verified Proof See how Neo continuously combines code understanding and runtime exploitation to find business logic flaws, complex IDORs, and auth bypasses that black-box tools miss. [Watch the Webinar](https://projectdiscovery.io/webinars/continuous-pentesting-verified-proof) ## Scale security services without scaling manual work Neo helps MSSPs turn pentesting, validation, and reporting into repeatable, evidence-backed delivery across every customer environment. [Read More](https://projectdiscovery.io/use-cases/neo-for-mssps) ## Try Neo at RSAC 2026 See how Neo delivers concrete proof and actionable next steps that keep security moving at engineering speed. [Read More](https://projectdiscovery.io/events/rsac-2026) ## Announcing the ProjectDiscovery OSS Bounty Program ### Democratizing Security, One Contribution at a Time Today, we're excited to announce the launch of the ProjectDiscovery OSS Bounty Program, a new initiative to reward meaningful contributions to our open-source security tools. ### The Vision At ProjectDiscovery, we've always believed that security should be accessible to everyone. Our tools are used by researchers, defenders, and builders worldwide. From Fortune 500 security teams to independent bug bounty hunters, from government agencies to open-source developers. [Read More](https://projectdiscovery.io/blog/announcing-the-projectdiscovery-oss-bounty-program) ## New Report: State of AppSec 2026 | Security at Engineering Speed In 2026, most organizations aren’t shipping “applications” so much as they’re shipping continuous change; across APIs and services, infrastructure and configuration, identity and permissions, feature flags, and AI-assisted code. [Read More](https://projectdiscovery.io/blog/new-report-state-of-appsec-2026-security-at-engineering-speed)