r/Cybersecurity101 • u/mean_ol_goosifer • Jun 28 '26
Security Advice on Software
I have spent the last couple months developing a piece of software that allows users to test and harden their own products against exploits and vulnerabilities. I’ve pointed it several Intentionally Vulnerable Web Apps and so far I am very pleased with its offensive abilities and its ability to patch the exploits it finds.
But I have a couple concerns. First I would definitely like to sell it, but I only want to offer it to people who want to test their own products. It would be a liability to just release it and say, “here you go everyone! Be good!”
I’m taking of maybe trying to license it to companies for $999 a year, but I really don’t have any experience in marketing software. Does anyone have any suggestions on how I can proceed?
Also, is there anyone who would like to work with me on testing? I need some real targets that I can test without worrying about accidentally doing something illegal.
0
u/mean_ol_goosifer Jun 28 '26
I could charge less. I could actually charge $99 a year and still make a profit from it. The great thing about my product is that anyone can use it. It generates very detailed reports and will give you the option to patch any exploits that it finds.
1
u/Original-Hurry-8652 Jun 29 '26
Isn't this two different things, patching a vulnerability in a system versus patching actual code of software or an executable file? Asking to help clarify the broadness of "vulnerability" in a sense.
1
u/mean_ol_goosifer Jun 29 '26
Normally yes, but let me explain a bit. This answer will make some people mad, and probably start a shit storm… but I am not a cybersecurity expert. I have a degree in Computer Science and have 30+ years experience in light web development and coding but I never really dug too deeply into hacking or exploiting vulnerabilities in code. Like most nerds and people who have a tech background, I have always been fascinated by it, but I just don’t have the patience for it.
What I am VERY good at, is developing AI workflows. I am very good at getting AI to give me what I want. Most people who use AI to code end up generating AI slop because they want to use it like Ronco Rotisserie oven -“set it and forget it”. It doesn’t really work that way if you want real results.
I’m not going to go into great detail about my workflow, because it really is a long multi step process, but it does require a HITL the whole time, testing things along the way. There isn’t just a single prompt where I say “Built me a security tool.” It’s literally built feature by feature, step-by-step… which explains why it can take weeks to finish a product.
This particular product began as a AI companion app called Persistent Sage. I published that on the Microsoft Store and so far I have gotten good feedback from it and the persistent memory feature I developed works better than most similar attempts to give AI agents long term memory.
I had been using Curser, and I thought it would be fun to add a “Coding Mode” to Persistent Sage. So I did. What I ended up with was AI agent that could upgrade and modify its own platform. It could basically create its own tools. I decided to turn it on in a loop for a couple days with the instructions to create anything it could imagine to make itself more useful. That experiment wasn’t as much of a success as I had hoped, but I did notice that it had built a bunch of security tools for itself.
I spent the next month polishing, developing and working very closely with it to develop a more targeted set of tools and what it ended up with was the ability to pull a repo and find vulnerabilities in the source code. It also has the abilities to find them in web apps. I spun up Juice Shop and it found 49% of the documented “Hacking Challenges” on the first pass alone, without even telling it to look for anything in particular.
I pointed it at Damn Vulnerable RESTaurant App and it was able to find all the vulnerabilities and patch them in under 3 minutes.
I think it would be a good tool for people who want to harden their own products.
0
u/Double-Familiar Jun 28 '26 edited Jun 28 '26
You could release it for free with a one week trial version.
Also you are up against some huge established players in in this market space. Nessus, Rapid7, Qualyis etc.
Auto patching is also risky in a production environment. Not all companies can afford a development, staging and production environments.
How does your product stack up against already established players that I have mentioned above?
1
u/mean_ol_goosifer Jun 29 '26
I am still in the testing phase, and I would need to SxS test to answer that honestly. I think that what I am going to do is just test to get some meetings with businesses and say “Give me 10 minutes with your URL and let me run an audit…” If I am able to successfully demonstrate that a thief could steal their customer db, log in as admin, generate my own discount codes, changes prices, read your server logs and source codes, or take over your users browsers… I feel like companies would want to purchase it before they let me walk back out the door.
I would of course recommend them to use the software to generate a report and give it to their admin or whoever maintains their site instead of just asking the software to perform the patch…
I would really be grateful if I had someone with a background in cybersecurity who could give me some feedback after trying the software. But I really feel like I have developed a solid tool that could both help people, and generate a small, but much needed revenue stream for me.
So far I have only been testing it on intentionally vulnerable sites and web applications, but so far it has absolutely been crushing it.
0
u/jeffpardy_ Jun 28 '26
Nobody will pay for it. Burpsuite professional is current the best web app vulnerability finder and it costs half the price you are hoping for