Xint Blog

Findings are not enough: Vulnerability Detection & Response and Vulnerability Evaluation & Reporting are now required to obtain or maintain FedRAMP Certification

Autonomous AI security tools can cause as much damage as they prevent if harnessed incorrectly. This is how Xint delivers best-in-class results without compromising security.

For startups where speed is of the essence, when and how should security checks are performed can either be an accelerant or a bottleneck

Xint achieves the world's leading standard for information security management, evaluating an organization's security policies, risk management practices, access controls, and incident response procedures.

What are the incremental benefits to each new (more expensive) model and when does it make sense to update?

Everyone is claiming AI in AppSec, but there are meaningful differences in how AI is used, leading to fundamentally differences in exposure

In an engagement with a healthcare client, Xint uncovered an IDOR vulnerability allowing unauthorized access to patients' protected health information (PHI).

Non-deterministic LLM vuln discovery is actually a strength for Xint since it can go beyond fixed rules or patterns that are easily gamed by attackers.

LLMs are changing the role of security researchers and engineers, but companies laying off human cyber experts just as AI coding generates more vulnerable code are in for a world of hurt.

A walkthrough of Copy Fail (CVE-2026-31431) as a container escape primitive: from a 4-byte page cache write to host root on Kubernetes.

We don’t know the FP rate for the latest frontier models when it comes to AppSec. We share ours and how we arrived at it.

This is an overview of the two kernel-level vulnerabilities uncovered by Xint Code in MacOS, iOS and iPadOS which have been patched by Apple

Zero data retention (ZDR) policies for LLMs in AppSec are not the default, but here's why they belong at the top of your AI procurement checklist.

These are the 8 questions that will tell you whether a vendor is selling a pen test alternative, a faster SAST tool, or a demo that doesn’t survive production

There's a difference between insecure code patterns and true vulnerabilities that hackers seek to exploit. Why does that matter?

The story behind CVE-2026-31789 demonstrates how DARPA and Xint are accelerating AI cyber defenses

Xint Code disclosed CVE-2026-31431, an authencesn scratch-write bug chaining AF_ALG + splice() into a 4-byte page cache write. A 732-byte PoC gets root on Ubuntu, Amazon Linux, RHEL, SUSE.

What do buyers actually purchase when they pay for a vulnerability discovery platform, and why is the model the cheapest input in the bill?

Press Release for April 21, 2026

In this exclusive report, Xint researchers compare Mythos's publicly disclosed results versus what broadly available models can accomplish using advanced scaffolding

While code is abundant, assurance is scarce. The winners won't be the teams that generate the most code, it’ll be the teams that can prove it's safe.

A critical CPython CVE today took less than 45 minutes of human work to find, triage, and fix because of Xint Code

Linear increases in code are leading to exponential token burn increases. Xint's orchestration brings clear, predictable pricing.

Even secure-looking code can hide dangerous flaws. Learn why business logic vulnerabilities are hard to detect and why most scanners miss them.

Real Vulnerabilities. Actionable Results.

An introduction to DARPA's AI Cyber Challnge and Theori's third place cyber reasoning system

How we learned to build effective LLM agents for hacking at DARPA's AI Cyber Challenge (AIxCC)