October 2026 Summaries

Detectify argues that security programs focused mainly on known CVEs can overlook substantial risk because many web-application flaws, including custom-code bugs, business-logic errors, misconfigurations, certificate problems, and dangling DNS records, do not receive CVE identifiers. Citing data from its platform, the company says most vulnerabilities in its test catalog and nearly all findings on customer assets are non-CVE issues. Its approach combines submissions from an ethical-hacker community, internal research into emerging technologies and attack methods, and an AI system called Alfred that prioritizes public CVEs using exploit likelihood, asset relevance, and threat intelligence before converting proof-of-concept information into tests reviewed by humans. Rather than relying on software-version matching, Detectify uses safe payload-based tests intended to confirm exploitability and reduce false positives, while providing severity assessments and remediation guidance. The discussion recommends maintaining a complete external asset inventory, monitoring DNS records for takeover risks, using research beyond public CVE feeds, and prioritizing confirmed exploitability alongside, rather than solely by, CVSS scores.