Security regression suites

A retest answers a one-time question: is this fix still holding right now? It fires the stored attack once and is gone. Security regression suites make that exploit durable and repeatable — you save it, group saved exploits together, and replay the group whenever you want. The result is a security regression test: ongoing proof that findings you’ve already fixed haven’t quietly come back.

Note

Regression suites are a Vortex Growth feature and are gated by their own Manage security regression allow-rule, granted separately from the other Remediation Queue permissions. Below Growth the page still opens and shows you what you’d get, but you can’t run suites.

The idea

• A saved exploit is a snapshot of one real Vortex finding — the exact payload that was fired, where and how it was fired, and the evidence that proves it worked. Saving it freezes that exploit so you can replay the identical attack later.
• A suite is an ordered group of saved exploits for a single site. Running the suite replays each exploit in turn and tells you which ones still reproduce.

Because a replay reuses the same free mechanism as a retest, running a suite doesn’t consume pen-test credits or scan slots, and the runs don’t show up in your report history.

Saving an exploit

Wherever you see a finding you’d want to keep watching — in a Vortex report or on a Remediation Queue card — use the Save to suite action. You can:

• add it straight into an existing suite, or
• save it as a standalone exploit to organize into a suite later.

Building a suite

Open Vortex → Regression tests to manage your suites.

1. Create a suite and pick the site it belongs to.
2. Add exploits. Use the picker to add one or several saved exploits at once — it’s filterable, so you can multi-select from a long list.
3. Order the exploits if the sequence matters to you.

One suite, one site

Every exploit in a suite must belong to the same site — a suite is replayed against one target, so mixing sites would make a run meaningless. The picker only offers exploits for the suite’s site, and a cross-site add is rejected.

Running a suite

Choose Run on a suite to replay every exploit in it, or run a single saved exploit on its own. Each exploit produces the same verdicts as a retest — Validated (the attack no longer works), Regressed (it still works, the finding is back), or Inconclusive.

A few things worth knowing about how runs behave:

• Exploits run one at a time, in order. A run is sequential, so a large suite takes as long as the sum of its replays.
• One run at a time per organization. If a run is already queued or in progress, starting another is refused until the first finishes — this keeps results clean and predictable. You can cancel a run in progress.
• A run that gets stuck is released automatically after a timeout, so a single hung exploit can’t lock you out of running suites.

Acting on the results

A Regressed verdict means a vulnerability you’d fixed is exploitable again — treat it exactly like a fresh finding: remediate it from the Remediation Queue. A suite that comes back all Validated is your evidence that the fixes it covers are still holding.

Note

Regression replays currently run on the Vortex AI engine regardless of which scan type originally found the issue. For findings first discovered by an Analog (DAST) scan, the replay is enriched with the original scanner’s technique so it reproduces the same attack, but the verdict is AI-verified rather than Analog-verified.

Next steps

• Retest a single fix on the fly: Reviewing & approving fixes.
• Remediate a regression: Remediation Queue.