- What it does: discovers assets, tests vulnerabilities, validates exploits and automates the path to a fix.
- The unusual move: Nuclei keeps detection logic in readable YAML templates instead of a vendor black box.
- Who pays: teams that want the open-source stack managed at scale, or Neo agents doing security work across code, cloud and runtime.
- The proof point: Elastic scanned 14,500 assets in under five minutes during a critical Next.js disclosure.
A smoke alarm has one job and one opinion. It decides what smoke looks like, shrieks when it sees enough, and offers no explanation. Most vulnerability scanners have historically behaved in much the same way, except that their alarms arrive as spreadsheets. The machine says a server may be vulnerable. An engineer spends Tuesday proving that it is not. By Wednesday, there are 400 more alerts.
ProjectDiscovery began with the impolite observation that this arrangement was backwards. The people closest to an application should be able to read the alarm, change the alarm and pass a better alarm to somebody else. Its flagship, Nuclei, separates a fast scanning engine from the checks it runs. Those checks are small YAML templates - plain enough to inspect, specific enough to reproduce and easy enough to share on GitHub.
That sounds like a technical detail. It is really the company's organizing idea. Four security engineers - Rishiraj Sharma, Sandeep Singh, Nizamul Rana and Marco Rivoli - met while collaborating in an open-source repository. They were employed elsewhere and assembling the scripts they needed to do their jobs. Subfinder found subdomains. HTTPx worked out which web services were alive. Naabu found open ports. Nuclei tested what was actually there. The company, founded in 2020, emerged after the toolkit had already found its audience.
“The mission of ProjectDiscovery is to democratize cybersecurity: to build the tools, the infrastructure and the data that empower anyone defending the modern internet.”ProjectDiscovery
The product was a grammar
Traditional scanners bundle the engine and the vendor's private library of checks. Nuclei made the check portable. A researcher can describe the request, the expected response and the evidence that counts as a match. Another researcher can audit it. A security team can adapt it to an odd internal application. When a new vulnerability appears, the community does not have to wait politely for a quarterly release.
The advantage is speed, but not only speed. Public logic makes disagreement useful. A loose matcher that mistakes a login page for a vulnerability can be challenged in an issue and repaired in the template. ProjectDiscovery says submissions are reproduced, reviewed for strict match conditions, independently validated by a second reviewer and monitored after release. By late 2025 it described a global bench of more than 10,000 contributors.
The first thing that failed was the old scanner
The founders' complaint was not that existing products found nothing. They found too much: false positives, inflated severity and results that could not be tailored to the architecture in front of them. The second failure was subtler. Open-source tools solved the detection problem but left the operator holding the plumbing.
Elastic's experience is the neatest example. Its security team already liked Nuclei and built a working system from bash scripts, cron jobs and a devbox. Then the apparatus began to sag. Cloud providers blocked or rate-limited the box. Scans took days. Revalidating fixes was repetitive. Findings hid in JSON files. The scanner was not the bottleneck; everything around the scanner was.
ProjectDiscovery Cloud was the answer: continuous asset inventory, distributed scanning, reporting, alerting and ticketing around the open tools. During disclosure of the Next.js authorization-bypass vulnerability CVE-2025-29927, Elastic used it to scan 14,500 assets in under five minutes. Work that had taken days became a coffee break. This is the company's commercial bargain in one scene: the detection remains legible; the inconvenient machinery becomes the paid product.
What changed their minds cost $1.7 million
ProjectDiscovery was maintained in spare time for roughly two years. The founders did not initially imagine it as a company. A growing community - including engineers from recognizable companies contributing code and showing their workflows - made the possibility difficult to ignore. A seed round in January 2021 let them go full-time. SignalFire led the $1.7 million financing, with Accel, Rain Capital and security leaders participating.
Seed capital in 2021 bought the move from nights and weekends to full-time open-source development.
CRV-led Series A capital in 2023 funded the enterprise cloud layer and commercial team.
The company now uses an open-core model without much coyness. More than 20 tools are available openly. The paid layer sells managed execution, workflow, integrations, identity controls and support. Neo's current self-serve plans begin at $200 per seat per month, with larger allowances at $400 and $800; enterprise contracts add private-network access, dedicated infrastructure, SSO, model controls and custom usage.
Neo is a new actor with the same old obsession
Neo arrived in limited release in December 2025 as an “AI security engineer.” The phrase invites eye-rolling, but the continuity matters more than the label. Nuclei asks for evidence rather than a vague software-version inference. Neo extends that idea into application behavior: map the system, form a hypothesis, run a test in an isolated sandbox, show the proof, open a ticket or pull request, then replay the exploit after the fix.
The audience has widened accordingly. Bug bounty hunters and penetration testers still use the CLI tools. Application-security teams connect GitHub and CI/CD. Cloud teams connect AWS, Azure, GCP and Kubernetes. Vulnerability managers send findings to Jira, Linear, GitLab or Slack. Named customers include Elastic, Paddle, ConnectWise, Factorial and Amplify. The common customer is not “a company with servers.” It is a technical team whose assets change faster than a periodic scan can describe them.
“We were already invested in Nuclei. ProjectDiscovery Cloud was the missing piece that let us scale it seamlessly across our environment.”Clement Fouque, Elastic
The copyable part is the sequence
There is a useful playbook here for developer-tool founders. Solve a recurring problem you personally feel. Make the smallest primitive composable. Publish the format, not merely a free tier. Let users teach one another. Keep the logic inspectable. Then charge for the operational burden that appears when the primitive succeeds: scheduling, scale, permissions, evidence, collaboration and support.
The conditions matter. A community detection library works when checks can be expressed cleanly and independently verified. It struggles when authentication, business logic or environmental context cannot fit inside a portable test. ProjectDiscovery's own AI-template experiment found weak matchers, inconsistent CVE data and particular difficulty with authenticated vulnerabilities; it kept manual review in the loop.
The useful caveat
Open contribution is not free labor without a bill. In 2026 ProjectDiscovery opened an OSS bounty program, then closed it after low-quality, heavily AI-generated submissions created more review overhead than value. Incentives increased output. They did not guarantee judgment. For a company whose promise depends on trustworthy detections, maintainer attention is part of the product.
Agentic testing raises the stakes further. An autonomous security system needs explicit scope, permission to test, safe targets, controlled credentials and humans who can decide what matters. Neo advertises sandboxes, audit logs and reviewable actions because offensive automation without boundaries is not efficiency; it is an incident. In regulated environments or production systems that cannot tolerate active testing, cautious deployment and enterprise controls are prerequisites, not accessories.
ProjectDiscovery won the 2025 RSAC Innovation Sandbox by returning to a decidedly unglamorous truth: security teams do not need another impressive pile of alerts. They need evidence they can understand and work they can finish. Nuclei made the alarm editable. Cloud made it operable. Neo is the bet that the alarm can now investigate itself - provided a human still decides where it is allowed to look.