Runtime Application Validation

Now pick what to compare Nuclei against.

Nuclei clear

Open a name for its full profile

Burp Suite Professional
Capabilities only
PortSwigger · Commercial · 3 capabilities in this domain
Compare →
Invicti
Capabilities only
Invicti Security · Commercial · 3 capabilities in this domain
Compare →
Pentera
Capabilities only
Pentera · Commercial · 3 capabilities in this domain
Compare →
Bugcrowd Platform
Capabilities only
Bugcrowd · Commercial · 2 capabilities in this domain
Compare →
Burp Suite DAST
Capabilities only
PortSwigger · Commercial · 2 capabilities in this domain
Compare →
Cymulate
Capabilities only
Cymulate · Commercial · 2 capabilities in this domain
Compare →
HackerOne Platform
Capabilities only
HackerOne · Commercial · 2 capabilities in this domain
Compare →
Mayhem
Capabilities only
Mayhem Security · Commercial · 2 capabilities in this domain
Compare →
NodeZero
Capabilities only
Horizon3.ai · Commercial · 2 capabilities in this domain
Compare →
Nuclei
Capabilities only
ProjectDiscovery · Open Source · 2 capabilities in this domain
selected
Synack Platform
Capabilities only
Synack · Commercial · 2 capabilities in this domain
Compare →
ZAP
Capabilities only
Checkmarx · Open Source · 2 capabilities in this domain
Compare →
AFL++
Capabilities only
AFL++ Project · Open Source · 1 capabilities in this domain
Compare →
AttackIQ
Capabilities only
AttackIQ · Freemium · 1 capabilities in this domain
Compare →
Bright DAST
Capabilities only
Bright Security · Commercial · 1 capabilities in this domain
Compare →
CI Fuzz
Capabilities only
Code Intelligence · Commercial · 1 capabilities in this domain
Compare →
Cobalt Pentest as a Service
Capabilities only
Cobalt · Commercial · 1 capabilities in this domain
Compare →
Contrast Assess
Capabilities only
Contrast Security · Commercial · 1 capabilities in this domain
Compare →
OSS-Fuzz
Capabilities only
Google Open Source Security Team · Free · 1 capabilities in this domain
Compare →
Picus Security Validation Platform
Capabilities only
Picus Security · Commercial · 1 capabilities in this domain
Compare →

In Runtime Application Validation

HackerOne Platform

HackerOne · Runtime Application Validation

Close ×

CommercialCompany

HackerOne connects organizations with a global researcher community and provides triage, program management and pentest services.

What it does3 capabilities · 2 at full coverage

2 of 3 at full coverage.

AI Red Teaming & Model EvaluationPartialAI · level 4 · 9 providers
Bug Bounty & Vulnerability Disclosure ProgramFullVALIDATE · level 3 · 2 providers
Penetration TestingFullVALIDATE · level 2 · 5 providers

What it proves15 controls across 9 frameworks

Satisfied through its capabilities, not claimed by the vendor.

CRA3 / 41Annex I Part II (3) Annex I Part II (5) Annex I Part II (6)
SSDF 1.13 / 42PW.8.2 RV.1.1 RV.1.3
AI RMF2 / 19MANAGE 1 MEASURE 2
CSF 2.02 / 106ID.IM-02 ID.RA-08
AICM1 / 18TVM
CIS Controls1 / 18CIS 18
LLM Top 101 / 10LLM04:2025
SAMM 2.01 / 90V-ST-3-B
Scorecard1 / 20Security-Policy

What it stops3 techniques · 1 risk

3 techniques countered, 2 of them common

LLM JailbreakAML.T0054Very Common
Craft Adversarial DataAML.T0043Common
Poison Training DataAML.T0020Emerging

1 risks reduced

Exploitable issues in running applications remain undiscoveredHigh

Where it runs2 phases · 2 ways to deploy

Capabilities per lifecycle phase

Test2
Operate2

How it is delivered

Managed serviceSaaS

What it unlocks4 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Penetration test critical applicationsMedium effort

Level 3

Authenticated testing and a disclosure programMedium effort

Level 5

Continuous AI red teaming and data integrity assuranceHigh effort
Continuous fuzzing and public bug bountyHigh effort

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsManaged service subscription

LicensingManaged service subscription

Priced perendpoint or user per year including service

BillingSubscription

Scales withCovered endpoints or users plus service tier

Total cost

Offsets analyst headcount; compare against fully loaded SOC staffing cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13