Vexta · Verified Vulnerability Scanning
Findings verified before you read them.
Vexta scans for 25+ vulnerability classes, then runs candidate findings through non-destructive verifiers that safely confirm or refute them - before a human ever sees the list. Optional AI, using your own key, adds context and remediation guidance on top of that verified list; it never decides what counts as real. Self-hosted as a single binary, so your scan results stay on hardware you control.
14-day free trial · 25 scans included
See it work
A real scan, start to finish.
69-second walkthrough - Screen recording of a Vexta scan running against a local test target, then a finding being triaged in the results view. Target host, finding text and license details are redacted.
The problem
A long list of findings is not the same as knowing what's real.
A scanner that fingerprints a version and matches it to a CVE feed can hand back hundreds of possible issues. Some are false positives, and some are unreachable or unexploitable in your actual environment. Your team spends days triaging, and the finding that mattered can get buried.
- Long unverified CVE lists that nobody has time to read
- Hard to tell a real, exploitable bug from a version match
- Severity scores that don't reflect whether the asset is reachable
- Scan data stored on someone else's servers when you would rather keep it in-house
Why Vexta
Built by pentesters. Tuned by AI. Verified before you read it.
Vexta pairs deep, OWASP-grade scanning with a proof-of-exploitation layer and an AI triage step, so what reaches you is short, ranked, and worth acting on.
Proof-of-exploitation
Before a finding reaches you, a non-destructive verifier tries to safely confirm it. Findings come back proven, refuted, or unproven - never a false 'all clear' just because the target blipped offline.
Vexta Confidence Score
Every finding gets a 0-100 score combining severity, detector confidence and proof status, plus EPSS probability and CISA KEV status on Pro and Enterprise and asset reachability on Enterprise. Sort by it and the findings worth acting on rise to the top.
25+ vulnerability classes
SQLi, XSS, SSRF, SSTI, XXE, IDOR/broken access control, request smuggling, GraphQL, SSO/OAuth/SAML, and more - not just CVE version-matching.
10,000+ community templates, bundled
Over 10,000 community detection templates from ProjectDiscovery's open-source nuclei-templates (MIT licensed), about 4,000 of them CVE-specific, ship inside the binary, and what they flag is checked by our own verifiers. On Pro and Enterprise a local NVD, EPSS and CISA KEV mirror syncs in the background, so CVE matching during a scan runs on local data instead of a live external feed.
AI-triaged findings
An LLM layer adds context and remediation guidance and flags likely false positives, without ever deleting a finding. It uses your own Anthropic, OpenAI, Gemini, or Azure OpenAI key, so finding data goes only to the provider you choose, and it stays off unless you turn it on.
CI/CD and reports humans read
SARIF and JUnit output drop into GitHub, GitLab, and Jenkins. Reports export to HTML, PDF, and Word with an executive summary and remediation steps - no exporting to a spreadsheet.
How it works
Point it at a target. Get a short, ranked, verified list.
Recon & fingerprint
Vexta maps the attack surface - subdomains, endpoints, technologies, exposed services - using 40+ passive sources plus active discovery.
Scan
It probes for 25+ vulnerability classes with type-aware payloads, CMS and API deep-scanners, and a local CVE database. WAF-aware throttling keeps it quiet.
Prove
Each candidate finding goes through a non-destructive verifier that safely confirms or refutes it. Network errors never produce a false 'refuted' - they stay unproven.
Rank & report
Findings sort by the Vexta Confidence Score, with AI-generated context and fix guidance if you connect your own AI key. Export to PDF, SARIF, or your bug-bounty platform.
Who it's for
One engine, three kinds of user.
SMBs without a security team
Run Essentials against your own app or let VITI run it for you. You get a short, prioritized list and plain-English fixes instead of a 200-line CVE dump you can't action.
Pentesters & bug-bounty hunters
Pro adds the full proof-of-exploitation engine, the intercepting proxy, PoC generation, and one-click export to HackerOne and Bugcrowd.
Learn more
Security teams & MSPs
Enterprise adds multi-seat RBAC, attack-path chaining, ASPM reachability scoring, and compliance reporting mapped to OWASP, NIST, PCI-DSS, and SOC 2.
Go deeper
See what else Vexta covers.
Every feature in one place
Recon, web, API and network scanning, proof-of-exploitation, the confidence score, optional AI triage and reporting, with what each plan includes.
Learn more
Pro and EnterpriseMobile app security
Upload an Android APK and get findings mapped to OWASP MASVS and CWE, from the manifest, the code, bundled libraries and native binaries.
Learn more
Bug bounty and authorized scope
Import a program's scope from Burp, HackerOne or Bugcrowd and Vexta refuses anything outside it, with an exact count of what it refused.
Learn more
What's under the hood
Vexta - the technical details
Is Vexta agent-based or agentless?
How is it different from Nessus or Qualys?
Is it self-serve or managed?
Is my scan data sent to a third-party LLM?
Which CI/CD platforms does it fit into?
How much does it cost?
Already running a free or open-source toolkit? See what Vexta adds on top →
Feature guides
How each part of Vexta works
One article per feature: what it does, how it works, and where it fits in a test.
Recon and attack surface
- Attack Surface Change Detection: How Vexta Tracks What's New Since Last Scan
- GitHub Dorking for Bug Bounty: How Vexta Hunts Leaked Secrets and Endpoints
- Passive Recon for Bug Bounty: How Vexta Pulls From 40+ Sources Before Sending a Packet
- Subdomain Takeover Detection: How Vexta Finds the CNAMEs Nobody Is Watching
- Vexta's DNS Resolver Pool for Reliable Recon
- Vexta's Per-Host Recon Depth on Every Asset Row
- Vexta's Per-Host Screenshot Snapshot Bundle
- WAF Detection in Vexta: Spotting a Firewall and Throttling Automatically
- Why an Exposed JavaScript Source Map Is a Bug Hunter's Shortcut
- Wordlist Management in Vexta: Custom Lists for Recon
Testing and detection
- Behavioral Anomaly Detection: How Vexta Flags a Response That Doesn't Fit
- Blind SSRF Detection: How Vexta's Built-In OOB Callback Server Proves It
- Continuous Bug Hunting Automation: Vexta's AI Loop and Hunt Mode
- How Vexta Detects HTTP Request Smuggling and Race Conditions
- How Vexta Fuzzes REST APIs Using Their Own OpenAPI Schema
- How Vexta Keeps an Authorized Scan Polite and In Scope
- How Vexta Tests for Business Logic Flaws Like Mass Assignment
- How Vexta Tests GraphQL APIs for Introspection and Auth Bypass
- How Vexta Tests SAML and OAuth Single Sign-On for Auth Bypass
- Secret Detection in Source Code: How Vexta Finds Leaked Keys
- Software Composition Analysis in Vexta: 7 Ecosystems Covered
- Vexta's Cloud Configuration Auditing for AWS, Azure and GCP
- Vexta's Intercepting Proxy and Repeater, Built Into the Scanner
- Vexta's Offline CVE Scanner: 10,000+ Templates, No Network Needed
- Vexta's Script Engine: 26 Bundled Checks Without an Nmap Dependency
- Vexta's WordPress, Drupal and Joomla Vulnerability Scanner
Verification and prioritisation
- Bring Your Own Key: How Vexta's AI Vulnerability Triage Works
- Cross-Scan Finding Deduplication in Vexta
- How Vexta Verifies a Vulnerability Fix Before You Close the Ticket
- How Vexta Verifies Every Vulnerability It Finds
- How Vexta's CISA KEV Coverage Tracker Works
- Per-Finding Triage State in Vexta
- Reliability Badges and False-Positive Tracking in Vexta
- Reproducible Vulnerability Evidence: Inside Vexta's Full HTTP Exchange Archive
- The Vexta Confidence Score: A Vulnerability Prioritization Score That Uses Six Signals
- Vexta ASPM: Asset Criticality Levels and SLA Bands
- Vexta Attack Path Chaining: From One Finding to Full Impact
- Vexta's Education Module: Why Every Finding Explains Itself
Reports and integrations
- Automating Vexta with Its REST API: Jobs, Scans and Assets
- Compliance Mapping in Vexta: OWASP, NIST, PCI-DSS, SOC 2
- Finding Lifecycle Metrics: MTTR and KPIs in Vexta
- SARIF and JUnit XML: Running Vexta Findings Inside CI/CD
- Vexta Notifications: Getting New Findings into Slack, Discord or Email
- Vexta's Bug Bounty Report Submission to HackerOne and Bugcrowd
- Vexta's Proof-of-Concept Generator for Bug Bounty Reports
- Vexta's Report Engine: HTML, PDF, Word and Google Docs, One Click Each
Running Vexta
- Deploying Vexta on an Air-Gapped or Offline Network
- How Vexta's Update System Keeps Your Scanner Current
- Scheduled Scans in Vexta: Cron Jobs and the Scan Queue Explained
- Targeted Subscans in Vexta: Rescan One Endpoint Without Redoing the Whole Job
- The Vexta Dashboard: Running and Reviewing Scans Without a Terminal
- Vexta Scan Profiles and the Finding Query Language
- Vexta's 7 Team Roles: Who Gets to Scan, Fix, Bill or Just Watch
- Vexta's Audit Log and Active Session Management
- Why Vexta's Findings Never Leave Your Machine
Stop drowning in low-signal scanner output.
Run Vexta on one target and see a short, verified, ranked list - or let our team run it for you. Either way, you get the same tool we trust on our own engagements.