PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Road to Top 1: How XBOW Did It

xbow.com | blog | #bug-bounty | #benchmark | #company-news | #hackerone | #ai-pentesting | #leaderboard
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Recounts how XBOW became the first autonomous pentester atop HackerOne's US leaderboard — from CTFs and custom benchmarks to open-source zero-days, then black-box bug bounties on live targets.
Published
Collected

Related coverage

vulnerability · xbow.com
Introducing XBOW
XBOW's founding manifesto: the AI pentester autonomously solves 75% of web security benchmarks (85% on its own novel set), with founder notes tracing the team from GitHub Copilot and Semmle.
blog · xbow.com
Grok 4.7 Is Different. So Is the Best Way to Use It.
XBOW tested Grok 4.7 on exploit crafting and agentic pentests: inside xAI's Build it improved substantially over 4.6, outside Build it slipped slightly—orchestration now matters as much as prompts.
blog · xbow.com
How to Run an AI Application Pentesting Vendor RFP: The Evaluation Framework that actually works
An RFP evaluation framework for buying AI application pentesting: separating true autonomous testing from scanners and AI-assisted workflows, with questions, criteria and scoring guidance.
blog · xbow.com
Legal Boundaries of AI Penetration Testing: Engagements, Laws & Permissions
A practitioner's guide to the legal boundaries of autonomous AI pentesting: why traditional authorization breaks down, and how scope, enforceable controls and evidence preservation should be designed.
blog · xbow.com
Post Purchase Guide: Is Your AI Pentesting Tool Actually Working? - 7-Step Renewal Decision Framework
Xbow's seven signals for renewing an AI pentesting tool: validated findings, authenticated coverage, false positives, developer feedback, retesting, deployment cadence and vendor support.
blog · xbow.com
BAS vs Red Team vs Pentesting: How to Choose the Right Security Test
BAS, red teaming, and AI pentesting answer different questions. Learn when to use each and how AI pentesting validates exploitable app risk.
Back