Hacktron AI pentest finds 27 true positives in Fider v0.33.0 for $350, versus $4,000 platforms in Doyensec comparison
Hacktron published a vendor blog post comparing its AI pentesting platform against XBOW and Aikido, using the benchmark target from a Doyensec head-to-head report (sponsored by Aikido). Doyensec scanned the open-source projects Fider and Photoview at $4,000 per repo per platform. The author ran Hacktron on Fider v0.33.0, at an estimated cost of $350 and about 27 minutes. It confirmed 31 findings, of which the author's manual validation found 27 true positives and 4 false positives, versus 24 for Aikido and 17 for XBOW per the article. This is a self-reported, vendor-authored comparison, not an independent finding, and it discloses no CVEs or IOCs.
Detalhes técnicos
- Hacktron launched 60 agents. It rated 6 findings critical and 14 high; after manual grading the true positives were 3 critical, 3 high, 3 medium, 13 low and 5 info.
- Only 22% of Hacktron's severity ratings matched the author's review, versus 76% for Aikido and 71% for XBOW. The author acknowledges that AI agents overstate severity (for example, a CSP-blocked XSS rated high).
- As ground truth, the author used recent Fider security fixes: Hacktron caught 8 of 10, including every critical and high issue. These were a pre-auth account takeover, SSRF, cross-tenant tenant takeover, brute-force account takeover, markdown/ATOM XSS and server-side JS injection. The two it missed were lower severity.
- The author says Hacktron routes work between stronger and cheaper models (Opus, Gemini Pro, Flash) to reduce cost.
Remediação
The article gives no specific remediation. Fider operators should ensure they run a release that includes the maintainers' recent security fixes. Buyers should treat vendor-run benchmarks with caution and validate AI-reported severities manually.
Linha do tempo
-
Hacktron AI pentest finds 27 true positives in Fider v0.33.0 for $350, versus $4,000 platforms in Doyensec comparison
ler a análise desta fonte ocultar
Hacktron published a vendor blog post comparing its AI pentesting platform against XBOW and Aikido, using the benchmark target from a Doyensec head-to-head report (sponsored by Aikido). Doyensec scanned the open-source projects Fider and Photoview at $4,000 per repo per platform. The author ran Hacktron on Fider v0.33.0, at an estimated cost of $350 and about 27 minutes. It confirmed 31 findings, of which the author's manual validation found 27 true positives and 4 false positives, versus 24 for Aikido and 17 for XBOW per the article. This is a self-reported, vendor-authored comparison, not an independent finding, and it discloses no CVEs or IOCs.
Technical Details
- Hacktron launched 60 agents. It rated 6 findings critical and 14 high; after manual grading the true positives were 3 critical, 3 high, 3 medium, 13 low and 5 info.
- Only 22% of Hacktron's severity ratings matched the author's review, versus 76% for Aikido and 71% for XBOW. The author acknowledges that AI agents overstate severity (for example, a CSP-blocked XSS rated high).
- As ground truth, the author used recent Fider security fixes: Hacktron caught 8 of 10, including every critical and high issue. These were a pre-auth account takeover, SSRF, cross-tenant tenant takeover, brute-force account takeover, markdown/ATOM XSS and server-side JS injection. The two it missed were lower severity.
- The author says Hacktron routes work between stronger and cheaper models (Opus, Gemini Pro, Flash) to reduce cost.
Remediation
The article gives no specific remediation. Fider operators should ensure they run a release that includes the maintainers' recent security fixes. Buyers should treat vendor-run benchmarks with caution and validate AI-reported severities manually.