How it works
Endpoint monitoring re-tests known findings against the current target. A check can replay a finding's proof-of-concept or a stored security scenario. AISafe enrolls a finding-derived scenario only after you mark its source finding fixed. This prevents a known, still-open vulnerability from appearing as a new regression on every check.
What triggers a regression
A regression occurs when a vulnerability marked fixed becomes exploitable again. This can happen when:
- A subsequent code change reverts or circumvents the fix.
- A dependency update reintroduces a vulnerability patched in a prior release.
- An infrastructure change exposes a mitigated attack vector.
Monitoring catches these so you do not have to wait for the next scheduled scan or a real attacker to discover them.
What happens when monitoring re-checks a finding
When a finding is marked fixed, monitoring keeps tracking it. On each check it replays the proof-of-concept or stored scenario. If the target is vulnerable again, AISafe:
- Raises a
monitoring.regressionevent. - Creates a new project finding with the replay evidence.
- Alerts you, so you can respond.
If the check passes, the source finding stays fixed and monitoring schedules the next re-check. The deterministic pass path does not call an AI model, so it consumes no model tokens or model cost. A network block or execution failure is inconclusive, not a pass; an unreachable target never appears secure.
What triggers an alert
AISafe notifies you when it detects a regression. It posts to Slack if you have connected it. You respond by opening the finding to see the regression details, investigating the cause, and fixing it. See Monitor for regressions.