March 2026: Web Applications, Attack Graphs and Ticketing

If February was about listening, March was about showing. Several pieces of Neuron that had been under construction since before launch were ready to talk about publicly, and we spent the month explaining them one at a time.

Three threads ran through the month: web application testing, Active Directory, and what happens to a finding after the report goes out.

Web testing, written up

The month opened with our write-up of the Neuron Burp Suite extension and web application tracking (opens in a new tab). It covers the full picture: sending an issue from Burp into the right engagement with its request and response attached, and the web application model that gives those findings a home.

The idea behind both is that Burp stays the testing engine and Neuron becomes the system of record. A finding is tied to the endpoint it affects. A manager can see which parts of an application were covered and which were not. A report reflects the work that was done, rather than a reconstruction of it from a folder of screenshots. For practices that test networks and web applications side by side, it also means both kinds of work live in the same structured system.

Attack graphs that belong to the engagement

Active Directory testing has a familiar annoyance. Graph tools tend to keep one shared database, so starting a new engagement means clearing out the last one. Teams running several internal assessments at once feel that every week.

In Neuron, every engagement keeps its own directory dataset and attack graph. Switch between engagements and each graph is still there. This month the graph work went further in two directions we care about for reporting: Neuron can now surface several alternative routes between two points instead of a single shortest path, and a picture of the chosen route can be captured straight into a finding that Neuron AI helps draft. The analysis and the write-up stay in one place.

We published two spotlights on this side of the platform. The AD attack paths page (opens in a new tab) explains the per-engagement model, and collaborative AD graphing (opens in a new tab) shows several testers working the same graph at the same time.

After the report

The last spotlight of the month looked past delivery. A finding is not finished when the client reads it. Someone still has to fix it, and that work is usually tracked in a ticketing system, which in most organizations means someone copying findings into tickets by hand.

Workflow Integrations (opens in a new tab) push approved findings into ServiceNow, so the record a remediation team works from matches the finding that was reviewed. We will have more to say on this in the coming weeks.

Looking ahead

March also brought a run of short videos to accompany each spotlight, alongside one for the Delivery Portal. They are a useful way to see a feature in under a minute, and we plan to keep making them.

Every product story mentioned here is on neuron.ws/news (opens in a new tab), and if you would like a walkthrough of any of it, book a demo (opens in a new tab).