Active AI Triager

What it is

JupiterSec produces ~150-200 raw findings per typical web app audit. Many are real; many are false positives (a SQL keyword in marketing copy flagged as SQLi, an HTML-encoded reflection flagged as XSS, a verbose error page flagged as info disclosure).

The Active Triager judges each finding with Claude (Haiku tier), with the ability to probe the live target to confirm or refute the hypothesis. It doesn’t just pattern-match against a false- positive list. It sends a request, reads the response, decides.

What it produces

Three outcomes per finding:

Verdict	What happens
Confirmed	Finding rewritten into Umbra’s voice with reproduction steps + real evidence; lands in the published report.
Rejected	Logged with reason; doesn’t appear in the report. The operator can browse rejections in the per-scan admin view.
Inconclusive	Lands in the per-scan review queue. Operator decides.

Every Triager judgement is cost-tracked against the scan’s $30 AI budget. Average Triager cost across 150 findings: $0.40-$0.80.

What to use it for

You don’t run it directly. It’s automatic on every Deep Audit scan after JupiterSec’s Phase 1 completes.

Why it matters

The state of the art for triaging DAST output is a manual analyst spending 4-8 hours per scan reading PoCs and dismissing junk. The Active Triager does the same work in 4-6 minutes for $0.50-ish, and because it can probe, it catches the “looks like XSS in static text but actually executes on /search” cases that a pattern-only filter would drop.

Why it’s valuable

The single biggest cost of running a vulnerability scanner at scale is human triage time. Active Triager turns that 4-hour analyst loop into a deterministic 5-minute pass, and the findings that reach your team have evidence the LLM already verified end-to-end.

How to use it

It’s on by default for every Deep Audit scan. No knob, no setup. The scan detail panel shows live Triager progress (✓ confirmed N / ✗ rejected M / ⚠ inconclusive K) as findings flow through.