Spend enough time mapping how real sites fall over and a pattern gets uncomfortable. In our own defensive write-ups — the WordPress attack surface, why "behind a CDN" is not the same as safe, the 167-byte request that saturates a worker pool — not one of the vectors that mattered was a catalogued CVE. There was no advisory to match, no signature to fire on. They were ordinary features being called in a way nobody had rate-limited, on a specific target whose particular shape made them dangerous. So we built a scanner that looks for that. It is called VectSpor, and this is the thinking behind it.

What template scanners are genuinely good at

Let us be fair to the incumbents first, because they earn their place. Tools like Burp, Nessus, Nuclei, and Acunetix are, at their core, exceptional pattern-matchers. They carry a large, well-maintained database of known vulnerability signatures and CVEs, and they check your target against every entry fast and reliably. If a known-vulnerable library version is exposed, a default credential is live, or a classic injection point is reachable, a good template scanner will find it. That work is essential and VectSpor does not try to replace it.

But notice the shape of what they do. A template scanner answers one question, thousands of times: "Does this target match a weakness someone has already described?" That is powerful and it is also, by definition, a rear-view mirror. It can only find the vulnerability classes that have already been named, written up, and turned into a signature.

The gap: the vector nobody wrote a template for

The weaknesses that hurt the operators we studied lived in the space the templates cannot reach — not because the tools are bad, but because these weaknesses are emergent properties of one specific system, not entries on a list:

  • Application-level resource exhaustion. An endpoint that is behaving exactly as designed, but that does two seconds of framework work per call and has no rate limit — so a modest number of concurrent requests exhausts the worker pool. There is no CVE for "this route is legitimately expensive."
  • CDN-bypass exposure. Every edge protection assumes traffic flows through the edge. An origin IP left reachable — via a stale DNS record, a certificate-transparency leak, an open port — quietly makes the entire CDN decorative. No template flags your own network topology.
  • CMS-specific worker-pool and batching limits. Endpoints that let a single request stand in for many units of work, sliding under protections that count requests rather than work done.

These are not obscure edge cases; they are how modern, availability-focused attacks actually operate. But finding them requires reasoning about this target — its stack, its endpoints, its capacity, how the pieces combine — rather than comparing it to a library. That is a different kind of task, and it is the task VectSpor is built for.

A template scanner asks, "Do you match a known bug?" The more useful question against a determined adversary is, "Given how this system is actually built, where would a thoughtful attacker push?" Those are not the same question, and only one of them has a database.

How VectSpor approaches it

VectSpor pairs a probe engine that characterises the target — its surfaces, its stack, its behaviour under measured load — with an AI reasoning layer that treats that profile the way a skilled human tester would: not by scanning a checklist, but by asking what this particular system's weak points are and how they might chain. The flow is deliberately linear, and it does not stop at "here is a problem":

  • Scan. You verify ownership of a domain, then let it map the attack surface and reason about target-specific vectors — including the application-level ones a signature database has no entry for.
  • Understand. Every finding comes with a severity score, a plain-English explanation of why it matters, and how a real attacker would chain it — not a cryptic reference number you then have to go research.
  • Fix. This is the part that closes the loop. Each finding carries a platform-specific remediation guide — SSH, cPanel, AWS, GCP, Azure, or Cloudflare — so the person who found the gap can also close it without leaving the tool and without translating generic advice into their own environment.

The "fix" half matters more than it sounds. A finding that a busy team cannot action is a finding that stays open. Meeting the operator where they actually work — their panel, their cloud, their edge — is how a scan turns into a closed gap instead of a backlog ticket.

Where the honesty lines are

Two things we are deliberate about, because a security tool that oversells itself is worse than none.

It augments a tester; it does not replace one. AI reasoning surfaces candidate vectors and explains them, but judgement, authorization, and context still belong to a person. VectSpor is a force multiplier for someone who already knows what they are doing — a way to see more of the surface faster — not an autopilot that decides on its own what is real and what to do about it.

It is a defensive instrument, used on systems you are allowed to test. Everything it does is in service of an operator finding and closing their own exposure before someone less friendly finds it first. The same discipline runs through all our work here: we describe how things break so defenders can fix them, and we do our own measurement on infrastructure we own. Scanning a system you have no permission to touch is not what this tool is for.

Where it is, and how to get in early

VectSpor is a native desktop application for security professionals, currently in private development. A few practical notes: there is no public download yet — access is by waitlist while we work with early testers — and it is built so your scans and their results stay on your own machine rather than in someone else's cloud. It is the product form of the same argument we keep making on this blog: that resilience against real, target-specific pressure has to be reasoned about deliberately, not assumed because a template scan came back clean. It sits alongside the way we already treat reliability under load and platform integrity as security concerns rather than ops afterthoughts.

If your infrastructure has to stay standing under real-world pressure, that is exactly who we built it for. You can read the product overview and join the early-access list at vectspor.orospor.com — or, if you would rather have our team map your surface directly, that is what our cyber defense practice does, and you can start a conversation any time.

VectSpor is a defensive security tool for authorized testing. Use it only on systems you own or have explicit written permission to assess.