Vulnerability Management

Once a scan successfully completes, the Strix Engine reports its findings back to the dashboard. The Findings tab acts as your command center for triaging and reproducing vulnerabilities.

Interpreting Findings

The Dashboard groups vulnerabilities logically. Each card contains:

• Title & Endpoint: E.g., SQL Injection on /api/users.
• Severity (CVSS): Calculated based on the vulnerability type and impact.
• Description: An AI-generated contextual explanation of why this specific endpoint is vulnerable, rather than a generic definition.

Reproducing with PoC (Proof of Concept)

One of the biggest advantages of an autonomous agent over a static scanner is that Strix actually exploits the vulnerability to prove it exists, thereby eliminating false positives.

Every critical finding will include a PoC.

TIP

What is a PoC? A Proof of Concept is the exact HTTP request, curl command, or payload the AI used to trigger the vulnerability. You can copy this payload and paste it into your own terminal or Burp Suite repeater to verify the finding manually.

Remediation Guidelines

Along with the PoC, Strix leverages its LLM core to provide customized Remediation advice. Instead of telling you to "use parameterized queries", Strix will analyze the specific framework it detected on your server (e.g., Express.js, Spring Boot) and provide code snippets tailored to your exact tech stack to fix the bug.

Exporting Reports

While the dashboard provides an interactive view, you can export findings for compliance or offline analysis. Navigate to the Reports tab to generate a consolidated PDF or JSON report of the entire pentest engagement.