August 2026: Scanner Triage, Offline AI and Attack Paths on Film

August was our busiest month on neuron.ws so far, with three new stories in a single week. Two of them were videos, a format we leaned into because some features are easier to believe once you have watched them work.

The network cable comes out

The first video, drafting a pentest finding with AI while the machine is offline (opens in a new tab), makes a point we have been making in writing for months. Neuron AI runs on the customer’s own hardware. To show it rather than claim it, the recording starts by proving there is no connection to the outside world, then has Neuron AI draft a complete finding from a tester’s notes anyway.

The draft is then compared with the team’s approved library, field by field, so the tester chooses between generated text and the house wording. That pairing matters to us more than the drafting itself. The AI reporting spotlight (opens in a new tab) explains the thinking in more depth.

One queue for every scanner

The main written story of the month was Scan Issues, a single triage queue for scanner output (opens in a new tab).

Scanners produce far more results than findings. Sorting the important from the noise usually happens in exported spreadsheets and vendor consoles, a long way from the report. Scan Issues bring that work into the engagement. Results from vulnerability, web, cloud and mobile scanners land in one queue, where the team can assign them, confirm them, dismiss them as false positives or accept the risk, with each decision recorded.

When an issue is worth reporting, Neuron checks the Findings Library (opens in a new tab) for approved language that already covers it, and promotes it into a finding with the scanner’s evidence attached. When a client later asks why a particular result is missing from the report, the reason is sitting right next to it.

From graph to finding

The month closed with a second video: turning an Active Directory attack path into a report finding (opens in a new tab), with no external graph server involved.

It follows one path from start to finish. A directory collection is imported into the engagement, the route to the most sensitive accounts is found locally, and that route becomes a finding. Neuron AI drafts the write-up, the diagram drops into the finding, and every object along the path is linked to it. Graph analysis and reporting usually happen in two different tools, sometimes owned by two different people. Here they are one step.

What tied it together

Looking back, all three stories share an idea we keep returning to: the evidence and the report should not drift apart. A scanner result, an attack path or an AI draft is only useful if it ends up in the deliverable with its origins intact, and if it never had to leave the customer’s network to get there.

Watch both videos and read the full Scan Issues story at neuron.ws/news (opens in a new tab), or see Neuron live in a demo (opens in a new tab).