If your application security program only tracks known Common Vulnerabilities and Exposures (CVEs), you’re probably missing a large share of your real risk.

Across the Detectify platform, 75% of the vulnerabilities in our test catalog and 99% of those we discover in customers’ assets are non-CVE vulnerabilities.

That makes public disclosures a poor measure of coverage on a modern attack surface. Below, we look at why so many vulnerabilities never get a CVE and how Detectify finds both kinds.

Why do some vulnerabilities have no CVE?

The CVE program is a foundation of the security industry, but it was built to catalog flaws in distributed software. A lot of what goes wrong in cloud-native web applications falls outside that scope, and scanners that lean mostly on CVE databases tend to miss it for a few reasons.

• Custom code and SaaS flaws. Bugs in custom web apps, business logic, path-based cross-site scripting (XSS) or specific software configurations rarely get a public CVE ID, since there’s often no vendor product to file them against.
• Slow disclosure. Getting a CVE assigned involves vendor coordination, triage, and paperwork. By the time it’s published and someone writes a public scanner template, attackers may have been using the flaw for weeks.
• Misconfigurations and subdomain takeovers. SSL/TLS hostname mismatches, expired certificates, and dangling DNS records are serious risks, yet they generally don’t qualify for a CVE.
• Too much weight on CVSS scores. When vulnerability management is sorted by CVSS, engineers end up chasing high-scoring CVEs that may have no working exploit, while exploitable issues without a CVE go unnoticed.

How Detectify sources vulnerabilities

To close that gap, Detectify feeds three research sources into one payload-based scan engine:

• Detectify Crowdsource, our private network of ethical hackers, which supplies most of our novel and non-CVE research.
• Our internal security research team, which digs into complex systems, API frameworks and new threat vectors, and builds specialized fuzzing logic.
• Alfred, our AI security researcher, which turns public CVE disclosures into automated tests.

1. Detectify Crowdsource

Most of our non-CVE detection starts with Detectify Crowdsource, an invite-only community of ethical hackers and security researchers from around the world. Here’s how it works:

• A researcher finds a new attack technique or zero-day in the wild and submits it to Detectify.
• Our team turns the submission into an automated, payload-based scanning module.
• Each time that module finds a vulnerability on a customer asset, the researcher who submitted it gets paid. Researchers earn more when their work protects more systems, which keeps everyone focused on coverage that matters in practice.

2. In-house security research

Our security research team spends its time on emerging web technologies, API frameworks and new kinds of attack surface. They write fuzzing logic and detection modules for the subtle issues that signature-based scanners tend to overlook.

3. Alfred, our AI security researcher

Public disclosures arrive faster than any human team can process them, so Alfred handles the volume. It continuously ranks newly disclosed CVEs by exploit likelihood (EPSS), relevance to customer assets, and threat actor intelligence. This means that CVEs that active groups are exploiting right now will receive coverage first. Alfred AI then analyzes public proofs of concept, turning them into payload-based tests crafted for Detectify. At the end of the procesa human researcher reviews every test before it goes live.

How does payload-based testing reduce false positives?

Finding non-CVE vulnerabilities only helps if your team can act on the results. Many CVE scanners rely on version-string matching, for example, flagging a server because its banner reports an outdated Apache version. That approach produces a lot of false positives.

Detectify uses payload-based testing instead. We only report a vulnerability after a safe payload runs successfully and proves the issue can be exploited. Your team gets high-confidence alerts with clear next steps, whether or not the finding has a CVE identifier.

The fix ships with the test

Every finding comes with a risk level, a description and references so your team can prioritize. For new critical and high-severity vulnerabilities, our researchers write remediation guidance at the same time as the test, so your engineers get a concrete fix instead of a link to a Wikipedia article. For older tests, Alfred is backfilling remediation across the catalog. And if your team needs a hand, our customer success team works as an extension of yours.

Looking past the CVE list

When you stop treating the CVE list as the full picture, you cut down on noisy false positives and start covering the 75% of vulnerabilities that public databases never catalog.

How to detect non-CVE vulnerabilities

To detect non-CVE vulnerabilities, you need to test how your applications actually behave, cover every asset you expose, and use research sources beyond public CVE feeds. These five steps cover the essentials:

1. Test with real payloads instead of software version checks. Send safe payloads that try to exploit the vulnerability, and only treat a finding as confirmed when the payload works. Version matching can only flag issues that already have a CVE.
2. Map your full external attack surface, including forgotten subdomains and root domains. You can’t test assets you don’t know about, and old marketing sites, staging environments and acquired domains are common places for unpatched issues.
3. Monitor DNS for dangling records that allow subdomain takeovers. A DNS record that still points to a deleted cloud resource lets an attacker claim that resource and serve content from your domain.
4. Bring in research from outside CVE feeds, such as ethical hackers and in-house research. New attack techniques are often known to researchers months before a CVE is published, if one is published at all.
5. Prioritize by exploitability, not CVSS score alone. A confirmed, exploitable misconfiguration deserves more attention than a high-scoring CVE with no working exploit.

FAQ

What is a non-CVE vulnerability?

A non-CVE vulnerability is a security flaw that has no entry in the public CVE database. Common examples include business logic bugs in custom applications, misconfigurations, expired certificates and subdomain takeovers caused by dangling DNS records.

Are non-CVE vulnerabilities less dangerous than CVEs?

Not necessarily. Whether a flaw has a CVE says nothing about how severe it is. A subdomain takeover or a logic flaw in a login flow can be just as damaging as a critical CVE, and it may stay exposed longer because fewer tools look for it.

Why don’t standard scanners find them?

Many scanners match software versions against CVE databases. If a flaw has no CVE, or lives in code that only your organization runs, there’s nothing for the scanner to match against.

How does Detectify find vulnerabilities that have no CVE?

Most of our non-CVE coverage comes from Detectify Crowdsource, where ethical hackers submit new techniques that we turn into automated tests. Our internal research team adds detection for new technologies and attack surfaces.

How does Detectify avoid false positives?

We use payload-based testing. A finding is only reported after a safe payload proves the vulnerability can be exploited, which removes most of the guesswork that comes with version matching.

The post How to detect non-CVE vulnerabilities that standard scanners miss appeared first on Blog Detectify.

We’ve been listening to dozens of CISOs. In roundtables, peer forums, customer and prospect calls, on the record, off the record, at event floors and dinners. And the same thing keeps coming up: the security program on paper and the one running in production are rarely the same.

There’s a gap between security policy and reality.

We have researched what leading teams are actually doing to close it, and turned it into practical insights for security leaders trying to move from policy to operational reality, packaged into a whitepaper, Operationalizing Secure by Design.

Most organizations already understand Secure by Design practices, grounded in CISA’s principles of taking ownership of customer security outcomes, embracing radical transparency, and building organizational structure to support these goals, and apply them on paper. 

The challenge is that shipping fast, managing legacy infrastructure, keeping decentralized teams aligned, and satisfying compliance requirements are all happening at once. And the attack surface keeps expanding regardless.

The result is a predictable failure mode: teams follow best practices on paper (such as NIST SSDF controls for threat modeling, secure coding, and periodic assessments), but attackers find the vulnerabilities that never got tested, or got deprioritized based on incomplete information.

The visibility problem is bigger than most boards realize

Boards seek assurance from CISOs and security teams. But assurance requires accurate, real-world, continuous visibility, and that’s precisely what most traditional models are failing to deliver.

Cloud adoption, API proliferation, decentralized development teams, and rapid deployment cycles have expanded the external attack surface faster than centralized governance can track. Legacy systems connect to modern infrastructure without adequate documentation, often because the original system owners have long since left the organization. Business units spin up services and tools outside formal approval processes. And annual penetration tests, by the time they’re completed, are already describing an environment that no longer exists.

The result is that most organizations are managing risk based on incomplete information. Attackers, meanwhile, are patient, targeted, and increasingly focused on application-layer weaknesses that point-in-time assessments consistently miss.

What mature programs are doing differently

The whitepaper identifies five operational shifts that distinguish leading programs from those still operating on legacy models.

Meaningful security metrics, not activity reporting. Boards and executive leadership need reporting that reflects actual risk reduction, not scan volumes or finding counts. “Total findings” is a vanity metric. “Average remediation time” is operational reality.

Mature programs track remediation speed, exploitability rates, and coverage across the attack surface,  indicators that support defensible reporting and credible conversations about budget allocation. When KPIs are poorly designed, teams optimize for audits instead of reducing risk.

Continuous validation instead of periodic testing. One of the clearest trends is the growing inadequacy of annual penetration testing. Modern application environments change too quickly for point-in-time assessments to provide meaningful assurance. Replacing them with continuous, payload-based testing changes the assurance model entirely, testing internet-facing applications, APIs, authentication flows, and production attack surfaces as environments evolve.

Critically, continuous testing depends on continuous discovery: organizations cannot continuously test what they cannot continuously see.

Live asset intelligence. You cannot govern what you cannot see. Maintaining an accurate, continuously updated inventory of externally exposed assets, APIs, and services is foundational to everything else: prioritization, remediation, board reporting, and regulatory compliance. Shadow IT, unmanaged SaaS services, exposed development environments, abandoned subdomains, and unmanaged cloud services are consistently among the largest sources of untracked exposure.

This becomes especially critical during mergers and acquisitions, where live asset intelligence enables organizations to rapidly assess newly expanded attack surfaces.

Risk prioritization tied to exploitability and business impact. Risk registers often fail because they become administrative exercises rather than operational tools. A high-CVSS vulnerability in an unused legacy system isn’t the priority. A low-CVSS flaw in a payment API is.

The organizations allocating remediation effort most effectively are connecting technical risk to four factors: external exposure, verified exploitability (through payload-based testing, not signatures), business criticality, and existing compensating controls. This makes investment decisions easier to defend, both internally and to the board.

Accountability embedded across the business. Security programs that depend entirely on a centralized team do not scale. As one CSO put it: “Whenever we try to centralize stuff, we fail. Security is one of those things that traditionally end up being a gatekeeper, someone who has to say no, and then people get annoyed.”

The CISOs making the most progress are embedding accountability into role definitions, performance reviews, and security champion programs, while retaining oversight at the center. Crucially, accountability becomes self-reinforcing when findings are trusted: developers who receive high-noise alerts ignore them; developers who receive verified, exploitable findings own the fix.

Turning principles into practice: realistic timelines

The whitepaper maps these shifts to a two-horizon execution model. In the first 90 days, the focus is on immediate wins: embedding threat modeling into project workflows, establishing baseline metrics and remediation KPIs, mapping the external attack surface to reduce unidentified assets, and integrating continuous validation into release processes.

Over the multi-quarter horizon, the work shifts to organizational alignment: building cultural accountability across product teams, decentralizing governance maturity to allow process variations, aligning risk management with business metrics, and establishing shared cross-functional ownership. These changes frequently take six months or longer in complex enterprises. Failure indicators include rising remediation timelines, persistent organizational friction, and disconnects between security tooling and engineering workflows.

The strategic case for acting now

The whitepaper’s core finding is that Secure by Design is no longer a compliance initiative. It is becoming an operational discipline, and the gap between organizations that have made this shift and those still running periodic assurance models is widening. The organizations that succeed will not necessarily be the ones with the most security tooling or the largest governance frameworks. They will be the ones capable of continuously validating what is exposed, exploitable, and operationally risky across rapidly changing environments.

For CISOs navigating board expectations, budget cycles, and an expanding threat landscape, the question is no longer whether to modernize the operating model. It’s about doing it in a way that delivers measurable results, builds internal buy-in, and keeps the business moving.

The full paper covers the five operational dimensions in depth: strategy, discovery, validation, governance, and metrics, along with an overview of the implementation timelines, governance models for decentralized organizations, and the interventions that enterprise security leaders are putting into practice right now.

Download Operationalizing Secure by Design. 

The post Operationalizing Secure by Design: a CISO’s guide to closing the gap between policy and reality appeared first on Blog Detectify.

For years, development and security practitioners have treated dynamic application security testing as a critical final safety check before code goes live. However, the external attack surface is expanding faster than mid-sized security teams can realistically manage. 

In this high-velocity environment, legacy DAST tools are increasingly failing to keep pace. When software volume decouples from security headcount, security engineers find themselves operating with persistent uncertainty about unseen exposure. 

The real challenge today is not just finding any vulnerability, but understanding which exposures are actually exploitable and require immediate attention.

The problem with checklist-driven DAST tools

Traditional DAST tools rely heavily on broad vulnerability signatures and static lists of common vulnerabilities and exposures (CVEs). 

This approach leads to a massive structural cost for the industry: alert fatigue. 

Legacy scanners flood development queues with thousands of unverified findings, turning expensive security engineers into manual triagers who spend hours filtering out noise rather than remediating risks. When your DAST tools create more busy work than actual value, development velocity grinds to a halt.

Relying solely on public CVE lists creates severe security blind spots. Public databases are misaligned with modern tech stacks. Only 20% of critical CVEs actually target application components, while 35% of real-world vulnerabilities never receive an identifier at all. Furthermore, legacy testing methods treat applications as static entities. They require intensive manual configuration for each endpoint, creating immediate blind spots the moment a development team spins up a new subdomain, deploys an unmapped cloud resource, or introduces a third-party integration.

Attackers do not follow a static checklist; they perform continuous reconnaissance to target unusual outliers and forgotten assets in the long tail of your attack surface.

Redefining vulnerability testing with payload-based accuracy

To build an AppSec program you can truly stand behind, your DAST tools must evolve beyond point-in-time signature matching toward real-world attacker methodology.

Some tools, like Detectify, replace outdated signature checks with deterministic, payload-based verification. Instead of guessing if a vulnerability exists based on a software version number, our engines execute safe, simulated exploit payloads against live target assets to confirm real-world exploitability.

This approach drives the false-positive rate down (in the case of Detectify, to an unmatched <0.3%), providing security teams with high-fidelity, actionable data they can immediately trust. When a finding enters your workflow, your developers receive clear remediation guidance and proof of exploitability, eliminating the frictional back-and-forth between security and engineering teams.

Combining attack surface monitoring with DAST tools

An effective dynamic scanning strategy cannot operate in isolation; it requires continuous attack surface intelligence. 

You cannot secure what you do not know you own. Security teams can pair continuous attack surface reconnaissance with deep application crawling and fuzzing to gain both a bird’s-eye overview of their perimeter and the technical depth required to neutralize flaws before exploitation.

Detectify continuously maps and tests your entire external attack surface, discovering all assets, IPs, subdomains, shadow IT, and infrastructure (acquired, for example, through M&As) within minutes of exposure. 

The platform then applies asset classification to prioritize your resources, intelligently recommending exactly where to deploy deep-dive application and API scanning profiles.

Human-engineered, machine-scaled

Security should run smoothly in the background so your team can focus on building features. Fueled by a global crowdsourced network of elite ethical hackers, Detectify converts newly uncovered exploit techniques into live scanner tests in under 15 minutes. This research-driven intelligence is put to machine scale through a next-generation machine learning fuzzing engine capable of generating up to 922 quintillion payload permutations per vulnerability check.

As engineering organizations transition toward autonomous workflows, DAST tools must adapt to support both human developers and autonomous AI agents. Detectify is deconstructing a decade of scanning expertise into modular micro-utilities to become the deterministic trust layer needed for agentic pipelines. 

Turn uncertainty into clarity, and start scanning your full environment with precision. Start a trial or book a demo. 

Frequently Asked Questions (FAQ)

Q: Why do traditional DAST tools fail modern AppSec teams?

A: Traditional DAST tools fail modern teams because they rely on static signature databases and version-matching, resulting in high false-positive rates and severe alert fatigue. Furthermore, legacy DAST tools require manual endpoint configuration, which fails to scale alongside automated deployment pipelines and rapidly expanding external attack surfaces.

Q: What should security teams look for in modern DAST tools?

A: Modern DAST tools should offer continuous, automated asset discovery paired with deterministic, payload-based verification. Instead of guessing if a vulnerability exists, next-generation DAST tools safely execute simulated exploits against live assets to confirm real-world exploitability, driving false positives down to less than 0.3%.

Q: How do payload-based DAST tools reduce alert fatigue for developers?

A: Payload-based DAST tools eliminate the frictional back-and-forth between security and engineering by providing high-fidelity, actionable data. Because the tool actively verifies the vulnerability rather than just matching a software version number, developers receive clear remediation guidance alongside verified proof of exploitability.´

Q: Can DAST tools integrate with autonomous AI workflows and pipelines?

A: Yes, next-generation DAST tools are moving away from dashboard-heavy interfaces built strictly for human review. Advanced platforms are deconstructing scanning expertise into modular micro-utilities, offering agent-native workflows, scriptable APIs, and MCP server support to serve as a deterministic trust layer for autonomous AI agents.

The post Why traditional DAST Tools fail modern AppSec teams (and how to fix it) appeared first on Blog Detectify.