Tessera

Every day seems like there's a new entrant in the autonomous AI AppSec space, each outdoing the last on some headline benchmark. Here are the 3 questions that get to the core of whether it will actually make your app safe in the real world. xint.io/blog/find-so...

Everyone Can Find Vulnerabilities Now. Here Is How To Tell Them Apart. - Xint

Winning at benchmark leaderboards is not the same as securing your applications in the real world. This is how to tell the difference.

xint.io

Product Security teams are drowning in a deluge of findings. See how Xint has become their central platform to dedupe, validate, and patch findings coming from a variety of sources like bug bounty programs, frontier models, and even other cyber tools xint.io/blog/finding...

Findings Management to Combat Report Overload - Xint

How Xint can act as your central findings management platform to rationalize findings coming from various sources. | Product

xint.io

Findings Management to Combat Report Overload - Xint

How Xint can act as your central findings management platform to rationalize findings coming from various sources. | Product

xint.io

In our analysis of flaws in AI coding, we found the most common critical flaw was hardcoded secrets b/c copy-paste quick-start defaults dominate training data and do not change whether the app runs so a “does it work” check never surfaces them. Check out the report go.xint.io/the-top-secu...

The Top Security Vulnerabilities Generated by AI Code

What Al-generated apps get wrong: a vulnerability study across models, vendors, languages, and a real-world app

go.xint.io

“The vulnerability classes that models still struggle with are those that require system-level understanding.” Xint CTO/co-founder was interviewed by @helpnetsecurity.com about why AI code is predisposed to certain types of flaws www.helpnetsecurity.com/2026/07/23/r...

The AI code vulnerabilities that grow with your app - Help Net Security

A study of 28 AI-built apps maps the top AI code vulnerabilities, from missing rate limits to hardcoded secrets and IDOR at scale.

helpnetsecurity.com

Xint researcher provides an overview of his study detailing the kinds of flaws that AI code produces for Cyber Security News: cybersecuritynews.com/what-434-ai-...

What 434 AI-Generated Vulnerabilities Reveal About Secure Software Development

New research finds that modern AI coding models frequently generate insecure code that exposes AI-generated applications to denial-of-service attacks, hardcoded secrets and authorization failures.

cybersecuritynews.com

🚨 new Xint research 🚨 Previous studies demonstrate that AI code tends to have more flaws, but we looked at what specific **types** of flaws AI is prone to producing and why. What we found is helpful for dev and prodsec so they know what to look for when reviewing AI code. go.xint.io/the-top-secu...

The Top Security Vulnerabilities Generated by AI Code

What Al-generated apps get wrong: a vulnerability study across models, vendors, languages, and a real-world app

go.xint.io

Xint found three high-sev bugs (7.8+ CVSS scores) in Android that were patched in June. What made these bugs severe is they required **no** user interaction for an attacker to escalate permissions. xint.io/blog/xint-co...

Xint Code Discovers Three High Sev Bugs in Android - Xint

This is an overview of the three high-severity vulnerabilities uncovered by Xint Code in Android which have now been patched by Google Devices | Vulnerability…

xint.io

In June CISA issued Binding Operational Directive 26-04 throwing out the flat remediation clocks that governed federal patching for years and replaced them with a risk model built on four questions: xint.io/blog/fedramp...

FedRAMP Just Retired the Flat Scan. The New Rules Ask for Proof of Exploitability. - Xint

Findings are not enough: Vulnerability Detection & Response and Vulnerability Evaluation & Reporting are now required to obtain or maintain FedRAMP Certificati…

xint.io

Announcing the launch of Xint Pulse - the full power and capabilities of Xint but for one-time scans of live apps. xint.io/blog/xint-pu...

Announcing Xint Pulse - The Full Capabilities of Xint Served One Scan at a Time - Xint

Xint Pulse offers one-time scans of web applications powered by the full award-winning capabilities of the Xint enterprise platform | Product, News, AI for Sec…

xint.io

CISA and FedRAMP have formalized the move away from the # of findings to now focusing on exposure + exploitability. For legacy providers this is the end of their old model, which relied on surfacing 100s or even 1000s of possible code pattern weaknesses with every scan xint.io/blog/fedramp...

FedRAMP Just Retired the Flat Scan. The New Rules Ask for Proof of Exploitability. - Xint

Findings are not enough: Vulnerability Detection & Response and Vulnerability Evaluation & Reporting are now required to obtain or maintain FedRAMP Certificati…

xint.io

Xint by Theori @xint-io.bsky.social · 4w ago

How did one researcher's intuition combine with the scalability of AI to find the biggest Linux threat in years? Xint researcher Taeyang Lee will be presenting a deep dive at the Off By One Conference about his discovery of the Copy Fail Linux bug offbyone.sg/talk/taeyang...

OFF-BY-ONE 2026 - Singapore // 14-15 Sept

Off-by-One is Singapore's annual cybersecurity conference for the offensive security community. Two days of deeply technical talks covering vulnerability research, reverse engineering, exploit develop...

offbyone.sg

The advantage of true AI AppSec is how it adapts the attack based on context like a human attacker would. AI wrappers to traditional automatic scanners help insofar as they reduce false positives but they do not have the same adaptability as true AI AppSec xint.io/blog/ai-wrap...

AI Wrapper vs. AI Native - Xint

Everyone is claiming AI in AppSec, but there are meaningful differences in how AI is used, leading to fundamentally differences in exposure | AI for Security,…

xint.io

bymayachen.bsky.social @bymayachen.bsky.social · 4w ago

Yeah, the agent orchestration layer is where you actually earn your money. Most teams treat it like middleware that ships yesterday. The guardrails piece you're describing—that's not a checkbox, that's the whole game.

Xint by Theori @xint-io.bsky.social · 4w ago

55,000+ hours of disruption-free testing across 2.5k+ domains in actual operating environments of major corporations and financial institutions. That's not a happy accident. It's the result of years of experience before unleashing autonomous AI agents into live environments. xint.io/blog/safe-au...

How to Safely Implement Autonomous AI Agents for Pentesting Live Apps - Xint

Autonomous AI security tools can cause as much damage as they prevent if harnessed incorrectly. This is how Xint delivers best-in-class results without comprom…

xint.io

Xint by Theori @xint-io.bsky.social · 4w ago

Our team's experience in practical offensive security is why we built Xint understanding what guardrails autonomous agents need when doing penetration testing on a live application - otherwise AI security can cause the same issues it was meant to prevent xint.io/blog/safe-au...

How to Safely Implement Autonomous AI Agents for Pentesting Live Apps - Xint

Autonomous AI security tools can cause as much damage as they prevent if harnessed incorrectly. This is how Xint delivers best-in-class results without comprom…

xint.io

Get on the list for Xint Pulse - all of the capabilities of the award-winning Xint platform with no annual commitments. This is ideal for one-off compliance tests or startups/SMBs serious about securing their applications with limited budgets. xint.io/pulse-waitlist

"Our attack surface is expanding, but adding headcount is an impossibility." We are not trying to automate the human out of the loop. xint.io/blog/ai-cybe...

AI won’t replace human pentesters and security teams. It will be a force multiplier - Xint

LLMs are changing the role of security researchers and engineers, but companies laying off human cyber experts just as AI coding generates more vulnerable code…

xint.io

🚨 Interested in the quality of Xint results but needed a 1-time scan of a single live app (for example, for a one-time compliance scan of a vendor) instead of a longer-term commitment for several apps, servers, and APIs? Get on the waitlist for Xint Pulse - coming soon! xint.io/pulse-waitlist

Xint Pulse Waitlist | Full Pentest, No Subscription

Join the Xint Pulse waitlist. Get a complete pentest for a single app, no subscription, no contract. Be first to know when Pulse launches.

xint.io

Product Security is paying vendors to find vulnerabilities hackers will try to exploit. What they get instead is lists of hundreds (possibly) thousands of possible code weaknesses that add more noise instead of providing focus. xint.io/blog/171258

Vulnerabilities vs. Weaknesses: Why the Distinction Matters - Xint

There's a difference between insecure code patterns and true vulnerabilities that hackers seek to exploit. Why does that matter? | Vulnerability Research, AI…

xint.io

Speed wins - especially for startups. The ability to **securely** ship new features and updates is critical for building customer delight and trust at the same time. See how Z Enterprise does exactly that with Xint xint.io/blog/fintech...

How a FinTech Startup Accelerates Rapid Product Iteration Without Introducing Security Gaps With Xint - Xint

For startups where speed is of the essence, when and how should security checks are performed can either be an accelerant or a bottleneck

xint.io

Xint is now a certified platform with ISO/IEC 27001:2022 for information security management systems and ISO/IEC 27017:2015 for cloud service security. xint.io/blog/xint-du...

Xint Achieves Dual ISO Certifications, Accelerating Global Security Compliance Roadmap - Xint

Xint achieves the world's leading standard for information security management, evaluating an organization's security policies, risk management practices, acce…

xint.io

Unlike traditional DAST, which performs fixed tests targeting the same endpoints and APIs every time, Xint is intentionally designed so that individual scans run independently in a new context each time. xint.io/blog/ai-appl...

FAQ: Is AI Application Security Testing Reliable If Results Vary Between Scans? - Xint

Non-deterministic LLM vuln discovery is actually a strength for Xint since it can go beyond fixed rules or patterns that are easily gamed by attackers. | Produ…

xint.io

The latest models might show 10% improvements in certain benchmarks but increase costs by 2-10x depending on the complexity of the task. How do we deliver frontier-like performance while still maintaining predictable app/code scanning costs? xint.io/blog/increme...

FAQ: Are the Incremental Improvements in New Models Worth the Higher Cost? - Xint

What are the incremental benefits to each new (more expensive) model and when does it make sense to update? | AI for Security, Product, FAQ

xint.io

Just Security@justsecurity.org · 2mo ago

We've been saying reliance on any one model, no matter how SOTA, is neither cost effective nor even that performant. Now it might not even be that reliable. xint.io/blog/167832

System, Not Model: Why LLMs Do Not Replace Pen Tests - Xint

The model is only one input in AI vulnerability discovery. Targeting, context, validation, reporting, and scaffolding are what make it a real product. | Vulne…

xint.io

Following Friday's significant developments with Anthropic AI and US government ... Former National Security and State Department legal adviser, Brian Egan, discusses "unprecedented" U.S. export controls on Anthropic's Mythos and Fable.

While certain governments are building clear offensive and defensive security policies with real resources put behind enforcement and compliance... federalnewsnetwork.com/commentary/2...

The AI arms race everyone’s ignoring | Federal News Network

We must significantly overhaul our compliance requirements and how they’re enforced and implemented.

federalnewsnetwork.com