"Potentially vulnerable" is the weakest of all results in a report: it forces the customer to check for themselves whether it really is on fire. SecTepe SnapScan therefore takes a controlled step further and can actively verify vulnerabilities – graduated, opt-in, and fully logged. And when a new critical CVE appears out in the wild, the platform retests the entire engagement fleet against it at the push of a button.
Three Graduated Exploitation Modes
Active exploitation is generally locked behind allowActiveExploitation and staged in three levels, so the proof goes exactly as deep as the mandate permits:
oob_only: only an out-of-band callback (DNS/HTTP) proves that code was executed – without reading anything on the target.command_proof: a single read-only command such asidorhostnametangibly demonstrates code execution without altering the system.reverse_shell: the deepest level – and deliberately protected by a second, separate opt-in.
An exploit library matches findings to suitable techniques, including log4shell, spring4shell, java_deserialization, ssti, and cmd_injection. Every attempt is recorded as an ExploitSession or ExploitCommand – whoever reads the report sees exactly what was tried and what succeeded.
Proof Instead of Assumption – but Cleanly Bounded
The decisive point is the boundary: the callback runs over a defined public address (EXPLOIT_OOB_PUBLIC_URL), the modes build on one another, and nothing happens without explicit approval. This yields a robust proof of exploit that ends the "is this exploitable or not?" debate in the final report – without endangering the target system.
Rapid Response: One New CVE, the Whole Fleet Retested
The second building block connects SnapScan with the threat intelligence of the SecTepe suite. When a new critical CVE is published, a CTI trigger from SecTepe.Core initiates a rapid response: with a single API call the platform tests the entire engagement fleet against exactly that CVE – as cheap verify scans with a single nuclei template instead of a full rescan. The upper bound is controlled by RAPID_RESPONSE_MAX (default 500 target hosts).
This shortens the span between "CVE is public" and "we know which of our managed systems are affected" from days to minutes – a central building block for N-day management.
Interplay Within the Suite
Active exploitation delivers the proof that the AI pentest agent and the in-network runners gather; rapid response closes the loop to threat intelligence. Via the MCP findings export, the verified results are then available in a governed way for SOAR and GRC.
Conclusion
With graduated, opt-in-controlled, and fully logged active exploitation, SnapScan turns assumptions into proof – and with CTI-triggered rapid response, a new CVE becomes a robust exposure statement within minutes. That is the difference between a scan report and operational security work.