Skip to content
VITI Security
Contact

Vexta · Verified Vulnerability Scanning

Findings verified before you read them.

Vexta scans for 25+ vulnerability classes, then runs candidate findings through non-destructive verifiers that safely confirm or refute them - before a human ever sees the list. Optional AI, using your own key, adds context and remediation guidance on top of that verified list; it never decides what counts as real. Self-hosted as a single binary, so your scan results stay on hardware you control.

Start a free trial →See plans & pricing

14-day free trial · 25 scans included

See it work

A real scan, start to finish.

69-second walkthrough - Screen recording of a Vexta scan running against a local test target, then a finding being triaged in the results view. Target host, finding text and license details are redacted.

An expanded Vexta finding with triage controls (open, submitted, duplicate, paid, wontfix, ignored), confidence reasoning and compliance mappings. Vulnerability detail is blurred.
The Vexta dashboard: KEV catalog coverage, a new-scan form with detection profiles, and live activity.

The problem

A long list of findings is not the same as knowing what's real.

A scanner that fingerprints a version and matches it to a CVE feed can hand back hundreds of possible issues. Some are false positives, and some are unreachable or unexploitable in your actual environment. Your team spends days triaging, and the finding that mattered can get buried.

  • Long unverified CVE lists that nobody has time to read
  • Hard to tell a real, exploitable bug from a version match
  • Severity scores that don't reflect whether the asset is reachable
  • Scan data stored on someone else's servers when you would rather keep it in-house

Why Vexta

Built by pentesters. Tuned by AI. Verified before you read it.

Vexta pairs deep, OWASP-grade scanning with a proof-of-exploitation layer and an AI triage step, so what reaches you is short, ranked, and worth acting on.

Proof-of-exploitation

Before a finding reaches you, a non-destructive verifier tries to safely confirm it. Findings come back proven, refuted, or unproven - never a false 'all clear' just because the target blipped offline.

Vexta Confidence Score

Every finding gets a 0-100 score combining severity, detector confidence and proof status, plus EPSS probability and CISA KEV status on Pro and Enterprise and asset reachability on Enterprise. Sort by it and the findings worth acting on rise to the top.

25+ vulnerability classes

SQLi, XSS, SSRF, SSTI, XXE, IDOR/broken access control, request smuggling, GraphQL, SSO/OAuth/SAML, and more - not just CVE version-matching.

10,000+ community templates, bundled

Over 10,000 community detection templates from ProjectDiscovery's open-source nuclei-templates (MIT licensed), about 4,000 of them CVE-specific, ship inside the binary, and what they flag is checked by our own verifiers. On Pro and Enterprise a local NVD, EPSS and CISA KEV mirror syncs in the background, so CVE matching during a scan runs on local data instead of a live external feed.

AI-triaged findings

An LLM layer adds context and remediation guidance and flags likely false positives, without ever deleting a finding. It uses your own Anthropic, OpenAI, Gemini, or Azure OpenAI key, so finding data goes only to the provider you choose, and it stays off unless you turn it on.

CI/CD and reports humans read

SARIF and JUnit output drop into GitHub, GitLab, and Jenkins. Reports export to HTML, PDF, and Word with an executive summary and remediation steps - no exporting to a spreadsheet.

How it works

Point it at a target. Get a short, ranked, verified list.

01

Recon & fingerprint

Vexta maps the attack surface - subdomains, endpoints, technologies, exposed services - using 40+ passive sources plus active discovery.

02

Scan

It probes for 25+ vulnerability classes with type-aware payloads, CMS and API deep-scanners, and a local CVE database. WAF-aware throttling keeps it quiet.

03

Prove

Each candidate finding goes through a non-destructive verifier that safely confirms or refutes it. Network errors never produce a false 'refuted' - they stay unproven.

04

Rank & report

Findings sort by the Vexta Confidence Score, with AI-generated context and fix guidance if you connect your own AI key. Export to PDF, SARIF, or your bug-bounty platform.

Who it's for

One engine, three kinds of user.

SMBs without a security team

Run Essentials against your own app or let VITI run it for you. You get a short, prioritized list and plain-English fixes instead of a 200-line CVE dump you can't action.

Pentesters & bug-bounty hunters

Pro adds the full proof-of-exploitation engine, the intercepting proxy, PoC generation, and one-click export to HackerOne and Bugcrowd.

Security teams & MSPs

Enterprise adds multi-seat RBAC, attack-path chaining, ASPM reachability scoring, and compliance reporting mapped to OWASP, NIST, PCI-DSS, and SOC 2.

What's under the hood

10,000+
Community detection templates bundled (ProjectDiscovery nuclei-templates), checked by our own verifiers
25+
Vulnerability classes detected
1
Self-hosted binary, no Docker or external database

Vexta - the technical details

Is Vexta agent-based or agentless?
Agentless. You don't install anything on the systems being scanned. Vexta reaches targets over the network - web apps, APIs, hosts, exposed services - the same way an attacker would. The only thing you install is the Vexta binary itself, on a machine you control.
How is it different from Nessus or Qualys?
Nessus (Tenable) and Qualys VMDR do more than match versions: both run remote and authenticated checks and help you prioritise - Nessus with CVSS, EPSS and Tenable's VPR, and Qualys with TruRisk and its Qualys Detection Score, which factor in CVSS, EPSS, CISA KEV and threat intelligence. Qualys also offers exploit validation through TruConfirm in its Enterprise TruRisk Management platform. Vexta's approach is to try to safely confirm findings with non-destructive verifiers before they reach you, mark each one proven, refuted or unproven, and rank everything with a 0-100 Vexta Confidence Score that combines severity, detector confidence and proof status, plus EPSS probability and CISA KEV status on Pro and Enterprise and asset reachability on Enterprise. It runs as a single self-hosted binary on infrastructure you control. The fairest comparison is to scan the same target with each tool and compare the results.
Is it self-serve or managed?
Both. You can license Vexta and run it yourself (Essentials, Pro, or Enterprise), or have VITI run it for you as part of a VAPT engagement, using the same tool we sell.
Is my scan data sent to a third-party LLM?
Only if you turn AI features on, and only with a key you provide. AI triage is bring-your-own-key (Anthropic, OpenAI, Gemini, or Azure OpenAI), and the AI discovery loop has a per-scan cost cap. With AI disabled, Vexta still scans, verifies, and ranks - it just skips the LLM-generated context. Scan results, audit logs, and findings stay on the machine where the binary runs unless you turn on an integration that sends them out; our servers only see your license key, hardware ID and machine name, plus update and template download requests.
Which CI/CD platforms does it fit into?
Vexta emits SARIF 2.1.0 and JUnit XML, so it fits GitHub Code Scanning, GitLab security dashboards, Jenkins, CircleCI, and TeamCity. The scan-ci command (Pro and Enterprise) has standard exit codes and JSON output, so any pipeline that can run a binary on a runner where Vexta is activated can gate builds on a clean scan.
How much does it cost?
There are three paid plans - Essentials, Pro, and Enterprise - that unlock features by license, all from the same binary. You can start with a free trial of Pro, no card required. Current numbers, currencies, and seat limits live on our pricing page.

Already running a free or open-source toolkit? See what Vexta adds on top →

Stop drowning in low-signal scanner output.

Run Vexta on one target and see a short, verified, ranked list - or let our team run it for you. Either way, you get the same tool we trust on our own engagements.

Start with Essentials →See plans & pricing