Skip to main content

How it works

Endpoint monitoring re-tests the proof-of-concepts of your known findings against the current state of the target. Each check picks a finding, replays its proof-of-concept, and compares the result to what it saw when the vulnerability was confirmed.

What triggers a regression​

A regression occurs when a vulnerability marked fixed becomes exploitable again. This can happen when:

  • A subsequent code change reverts or circumvents the fix.
  • A dependency update reintroduces a vulnerability patched in a prior release.
  • An infrastructure change exposes a mitigated attack vector.

Monitoring catches these so you do not have to wait for the next scheduled scan or a real attacker to discover them.

What happens when monitoring re-checks a finding​

When a finding is marked fixed, monitoring keeps tracking it. On each check it replays the proof-of-concept. If the PoC exploits the target again, AISafe:

  1. Raises a monitoring.regression event.
  2. Reverts the finding's status to open, or creates a new finding, depending on your configuration.
  3. Alerts you, so you can respond.

If the check passes, the finding stays fixed and monitoring schedules the next re-check.

What triggers an alert​

AISafe notifies you when it detects a regression. It posts to Slack if you have connected it. You respond by opening the finding to see the regression details, investigating the cause, and fixing it. See Monitor for regressions.