We've been testing a pretty sweet new feat for RAPTOR with the exploitability validation pipeline, which sits between vulnerability discovery & exploit generation.
Before, we be like:
scan → analyse → exploit
now, we is:
scan → validate exploitability → analyse → exploit
Typical flow now becomes:
1. Static or dynamic analysis identifies candidate vulnerabilities
2. Exploitability validation stage runs
3. Only validated findings proceed to exploit generation
4. Exploit proof of concept or patch generation follows
For us on the team, this is significant because it:
1. Reduces false positives that lead to meaningless exploit generation and token wastage (gotta be cost aware)
2. Forces the agent to reason about realistic attacker capabilities
3. Enables prioritisation based on real impact
RAPTOR now standardises human readable exploitability statuses, namely:
Exploitable
Confirmed
Proven
Disproven
Ruled Out
It's a big step forward and hopefully gives all insight into what we are working on moving forward.
Remember kids, Gobbles were amazing. Love you all
