"Possibly vulnerable" is the weakest result a report can give. It leaves the customer to check for themselves whether there really is a fire. So SecTepe SnapScan goes one controlled step further. It can actively prove that a weak spot is real. This happens in stages, only when you opt in, and with a full log. And when a new critical CVE shows up in the wild, the platform retests the whole engagement fleet against it at the push of a button.
Three Stages of Exploitation
Active exploitation is always locked behind allowActiveExploitation. It comes in three levels, so the proof goes exactly as deep as the mandate allows:
oob_only: only an out-of-band callback (DNS/HTTP) proves that code ran. Nothing is read on the target.command_proof: a single read-only command such asidorhostnameshows that code runs. The system is not changed.reverse_shell: the deepest level. It is protected on purpose by a second, separate opt-in.
An exploit library matches findings to the right techniques. These include log4shell, spring4shell, java_deserialization, ssti, and cmd_injection. Each attempt is logged as an ExploitSession or ExploitCommand. So anyone who reads the report sees exactly what was tried and what worked.
Proof Instead of Guesswork, With Clear Limits
The key point is the limit. The callback runs over a set public address (EXPLOIT_OOB_PUBLIC_URL). The modes build on one another. And nothing happens without explicit approval. The result is solid proof of exploit. It ends the "can this be exploited or not?" debate in the final report, and it does not put the target system at risk.
Rapid Response: One New CVE, the Whole Fleet Retested
The second building block links SnapScan to the threat intelligence of the SecTepe suite. When a new critical CVE comes out, a CTI trigger from SecTepe.Core starts a rapid response. With a single API call, the platform tests the whole engagement fleet against exactly that CVE. It does so with cheap verify scans that use a single nuclei template, not a full rescan. RAPID_RESPONSE_MAX sets the upper limit (500 target hosts by default).
This cuts the time between "the CVE is public" and "we know which of our managed systems are hit" from days to minutes. That makes it a key building block for N-day management.
How It Fits Into the Suite
The AI pentest agent and the in-network runners gather the data. Active exploitation adds the proof. Rapid response closes the loop to threat intelligence. Through the MCP findings export, the verified results then reach SOAR and GRC in a governed way.
Conclusion
SnapScan's active exploitation runs in stages, needs an opt-in, and is fully logged. It turns guesses into proof. CTI-triggered rapid response turns a new CVE into a solid statement about your exposure within minutes. That is the difference between a scan report and real security work in daily operations.