AI meets CTEM: Boosting efficiency in vulnerability scanning

ULTRA RED's research team has integrated AI into several core scanning capabilities, improving both detection accuracy and the ability to distinguish real vulnerabilities from false positives.

Current AI-powered capabilities

1. Secrets Detection

Traditional secrets detection tools use pattern matching to identify potential API keys and tokens. The problem: many variable names and placeholder values match the same patterns as real secrets, generating high false positive rates. ULTRA RED's LLM-based secrets detection distinguishes between actual secret values and variable names or placeholder strings — dramatically reducing false positives while maintaining high detection sensitivity.

2. Boolean-Based SQL Injection Validation

Boolean-based SQLi is notoriously difficult to validate automatically. The attack works by asking the database true/false questions and inferring data from the responses. ULTRA RED uses AI to identify real database usernames returned through boolean inference, distinguishing them from random strings and false matches that would otherwise generate false positives.

3. WebSocket Vulnerability Detection

WebSocket connections are persistent, bidirectional, and complex — making them difficult to test with standard scanning approaches. ULTRA RED uses real-time data analysis to identify vulnerabilities in WebSocket implementations, including injection flaws and authentication bypass issues.

4. IDOR Detection

Insecure Direct Object Reference (IDOR) vulnerabilities require testing whether one user's resources can be accessed using another user's credentials or identifiers. ULTRA RED automates this process using AI to identify and test IDOR scenarios across API endpoints.

Coming soon: AI-enhanced fuzzing for IIS Shortname Disclosure and threat-intelligence-derived proof-of-concept generation for newly disclosed CVEs.