Smart Triage

AI-powered, portfolio-wide vulnerability prioritization. Every open finding across DAST, SAST, SCA, and Secrets is scored 0–100 and sorted into four action buckets — combining fast heuristics with AI (Gemini 2.5) so you fix what matters and dismiss the noise.

What it is

Smart Triage looks at every open finding across all scan types — DAST, SAST, Supply Chain (SCA), and Secrets — and answers the only question that matters when the queue is long: what do I actually do about this one? Each finding gets a priority score (0–100) and a verdict, then lands in one of four buckets.

It runs as a hybrid pipeline: fast rule-based heuristics decide the clear cases instantly and for free; only the genuinely ambiguous findings are sent to an AI model for an expert-style judgement. The result is one prioritized list for your whole portfolio.

The four buckets

BucketPriority scoreMeaning
Fix Immediately
≥ 80True positive, highly exploitable, likely critical (often KEV-listed). Drop everything.
Fix Soon
50–79True positive, moderate impact / likely exploitable. Schedule it.
Monitor
< 50True positive but low exploitability or already mitigated (e.g. blocked by Shield WAF).
Dismiss
—Not a real problem: false positive, test/example code, or unreachable. (Confidence in “true positive” below 70%.)

How it decides

Each finding is scored on two axes: is it real?(confidence it's a true positive) and how much does it matter? (priority 0–100). The heuristics are tuned per scan type, then universal threat-intelligence modifiers are applied on top.

Per-type signals

  • DAST — vulnerability class drives it: SQLi / RCE / auth-bypass / IDOR score high; SSRF / open-redirect / TLS issues mid; info-disclosure / missing headers / source maps low. Captured evidence raises confidence.
  • SAST — rule + file context: the same rule in /test, /examples, or docs is scored far lower than in shipping app code. Injection CWEs (89/78/94) rank highest; an AI-flagged false positive is auto-dismissed.
  • SCA — reachability dominates: an unreachable or dev-only vulnerable dependency is pushed right down; reachable + direct + high CVSS is pushed up. A dev-only and unreachable dependency is treated as negligible.
  • Secrets — a verified secret (confirmed live) jumps to immediate; secret type (AWS / DB / private key vs. test/dummy) and string entropy adjust confidence.

Universal threat-intel modifiers

Applied to every finding, regardless of type:

  • CISA KEV (Known Exploited Vulnerability) → strong priority + confidence boost.
  • EPSS exploit-likelihood → boost when > 0.7 (high), smaller boost 0.3–0.7.
  • Public exploit available → priority boost.
  • Shield WAF protection → priority reduced — if your edge already blocks the attack path, it's mitigated. See Shield WAF.
  • Cross-finding correlation → a SAST finding independently confirmed exploitable by DAST gets a confidence + priority boost. Code and network-reachable = highest confidence.
  • Severity → Critical boosts priority and floors confidence; Low/Info reduces both.

Heuristics vs. AI

A finding goes to the AI model only when the heuristic is not confident (below 75%) or sits in the ambiguous middle(priority 35–75) with thin reasoning. Clear-cut findings — “SQL injection with proof”, “unreachable dev dependency” — skip the AI entirely, so most runs cost nothing.

How a run is triggered

  • Manual — the Run Triage button on the Smart Triage page (/triage). A re-run within 5 minutes returns the cached result unless you force it.
  • Automatic on scan — a completed scan can kick off a focused triage so new findings are prioritized the moment they appear.
  • Nightly — a scheduled run (daily, ~03:00 UTC) keeps every eligible org current as CVEs are re-scored. To save cost it skips orgs with no new High/Critical activity in the last ~28h, and won't re-run an org that succeeded in the last ~18h.

Plan requirement

Smart Triage is available on Business and above(Business, Enterprise, MSP, Partner). On lower plans the page shows an upgrade prompt. Runs are metered against your plan's triage-run limit.

The Smart Triage page

Open /triage in the dashboard. After a run you get:

  • Bucket cards — Fix Immediately / Fix Soon / Monitor / Dismissed, each with a count; click one to filter the table.
  • Run stats — total findings, how many were AI-analyzed vs. heuristic, duration, cost (or “Free”), and last-run time.
  • Filters — by action, finding type (DAST/SAST/SCA/Secrets), domain, and free-text search over the reasoning.
  • Results table — priority score, type, title + location, target, severity, age, suggested action, and signal badges (Shield-protected, KEV, public exploit, CVE).
  • Detail drawer — click any row for the full reasoning, confidence + exploitability, threat signals, context-aware remediation guidance, the model used, and per-finding actions.

Acting on a finding

From the table or the drawer you can:

  • Verify Fix (DAST) — replays the original exploit to confirm it's actually fixed (see Vulnerability Management).
  • Mark Fixed / Dismiss / Escalate — move the finding through its lifecycle.
  • Agree 👍 / Disagree 👎 — tell the system whether its verdict was right.

Your feedback (agree / disagree / fixed / dismiss / escalate) is recorded against each verdict to refine future prioritization.

Cost & model

AI triage uses Gemini 2.5 Flash-Lite, batched 10 findings per call. Heuristic decisions are free; only the ambiguous findings incur AI cost, which is tracked per run and per finding. In practice a full portfolio run is a fraction of a cent — on the order of ~$0.001 per 100 findings.

API

# Trigger a triage run (Business+; force bypasses the 5-min debounce)
POST /api/triage/smart
{"force": true}

# Latest run status + bucket summary
GET /api/triage/smart

# Per-finding results (filter by action / type / scan)
GET /api/triage/smart/results?action=fix_immediately&finding_type=dast

# Give feedback on a verdict
POST /api/triage/smart/feedback
{"result_id": "<id>", "feedback": "agree"}

What's next