From hypothesis to evidence: how Vorthix XOR-1 analyzes software

Vorthix XOR-1 is an AI-driven cyber reasoning engine. It forms hypotheses about how software can be attacked, tests them in isolation and reports only what the evidence supports.

Request a walkthrough About Vorthix XOR-1

What is the process?

Vorthix XOR-1 works in four phases: it models the target, forms ranked attack hypotheses, tests each one in an isolated sandbox, and reports a finding only when the evidence supports it. The Vorthix research team reviews every finding before delivery. When the evidence is not enough, the result is “insufficient evidence”, not a guess.

01 · Model

Vorthix XOR-1 builds a model of the target the way an attacker would

It ingests the repository or the compiled binary, builds it with runtime instrumentation, and maps every reachable entry point, sink and trust boundary. The goal is to understand what an attacker can actually touch before any hypothesis is made.

Entry points and trust boundaries
Instrumented build (sanitizers, coverage)
Source and binary inputs

02 · Hypothesize

It reasons about where the software is most likely to break

Candidate weaknesses are ranked by likelihood and impact. Parsers, decoders, deserializers and authentication paths come first. Security patches are read as claims: the engine looks for code paths where the fix’s assumption does not hold.

Ranked attack hypotheses
Patch-as-claim analysis
Targeted harnesses for the riskiest paths

03 · Test

Each hypothesis is tested in an isolated environment

Vorthix XOR-1 writes the test, runs it in an ephemeral sandbox and reads the result. For network-reachable issues it can stand up an attacker and a target and exercise the path end to end. A hypothesis that the evidence does not support is dropped, or left open as “insufficient evidence”, not guessed.

Reproducible proof of concept
Runtime trace from the sandbox
Attacker-reachability check

04 · Report

Engineers receive evidence they can reproduce, plus a drafted fix

The Vorthix research team reviews each finding before it is delivered. You receive a minimized reproducer, the runtime trace, the root-cause path, a suggested patch and a regression test that fails before the fix and passes after it.

Minimized reproducer
Root-cause path and suggested patch
Regression test

Continuous by design

Analysis that keeps pace with your releases

Connected to your delivery workflow, Vorthix XOR-1 re-evaluates changes against the whole attack surface, so new code is examined as it lands and resolved findings stay covered by the regression tests it wrote.

Diff-aware re-evaluation
CI/CD integration
Regression guards on every fix

How long does an analysis take?

It depends on the size and complexity of the target and on the attack surface in scope. Scope, expected timelines and the format of the handoff are agreed with you before an engagement starts, as described on the engagements page. Vorthix XOR-1 keeps working through its iteration budget instead of stopping at the first result, so a session builds a picture of the attack surface, not a single finding.

Where to go next

The Vorthix XOR-1 evidence standard: what has to be true before a conclusion is accepted.
Why we built Vorthix XOR-1: the failure modes of long-running AI agents and how we address them.
Solutions and industries: where teams apply it.
Research: coordinated disclosures and write-ups.

Request access

See how Vorthix works on your code

Access is currently by request for security teams and researchers.

Get started Contact the team

Working proof of concept
Sanitizer-backed trace
Suggested patch and regression test