Vulnerability triage. The same autonomous engine, applied to vulnerability findings.

Autonomous vulnerability triage is the process of evaluating each new vulnerability finding for severity, exploitability, environmental impact, chainability against other findings, and required response timeline, without requiring a human analyst to read, validate, and prioritize each finding manually.

Morpheus uses the same Attack Path Discovery engine that handles security alert investigation to process vulnerability findings. Same engine, different input format. The output per finding includes a chainability verdict, environment-specific impact analysis, and a recommended remediation order, produced inside compliance reporting windows that manual triage cannot meet.

Morpheus sits above your scanner. Per the public product positioning of Tenable, Qualys, Rapid7 InsightVM, and Wiz, those platforms focus on discovery: identifying findings across your environment. Morpheus focuses on triage: what to do about each finding, in what order, with what evidence, under which compliance clock.

These categories are complementary. You still need your scanner. What you need above your scanner is an autonomous triage layer that scales with the volume and richness of AI-discovered findings.

AI vulnerability discovery models find and validate software vulnerabilities at machine speed. Claude Mythos 5.1 is available to verified defenders through Anthropic’s Cyber Verification Program, OpenAI released GPT-6 Astra on September 3, 2026, and Google is offering Gemini 4 Argon to trusted defenders first through its Fairwind Program. Their findings carry significantly richer per-finding payloads than traditional CVE advisories (exploitation steps, verification results, blast-radius analysis, proposed remediation paths).

Morpheus processes AI-discovered findings through the same Attack Path Discovery framework that handles security alerts and traditional CVE-class findings from production scanners. The input format changes; the engine does not. Morpheus triages findings from production scanners (InsightVM, Qualys, Tenable) through the same engine.

Yes. OpenAI’s Codex Security has already shipped and is producing AI-discovered vulnerability findings in production codebases. Morpheus processes Codex Security findings through the same Attack Path Discovery framework that processes other AI-discovered findings and traditional scanner output. One engine, three input types, with a unified audit trail per finding regardless of source.

The broader category, multi-model vulnerability discovery, is already expanding: OpenAI’s GPT-6 Astra and Google’s Gemini 4 Argon arrived in September 2026. Morpheus is architected to support new discovery sources without code changes; new integrations are a configuration task.

The same Contextual Playbook Generation that drafts incident response playbooks drafts regulation-specific vulnerability disclosure structures at runtime: NIS2 24-hour notification format, DORA 4-hour notification format, CRA 14-day final report structure, SEC Item 1.05 disclosure, NYDFS 500 reporting.

The unified audit trail per finding is the evidence chain underneath all of these: same artifact, different output formats per regulation. The traditional approach reconciles outputs across scanner, ticketing, case management, and analyst notes after the incident; that reconciliation is what fails inside a 4-hour DORA window. Morpheus produces the regulator-readable evidence chain as a normal output of the triage workflow. See “AI-Discovered Zero-Days Meet NIS2” for the full regulatory breakdown →

Attack Path Discovery evaluates each vulnerability finding against your environment (asset inventory, identity exposure, network reachability, existing controls) and identifies which findings combine to form critical exploit paths. The chain detection is the same logic that maps cross-alert attack paths in alert investigation; the inputs are different but the reasoning is identical.

The canonical example: a CVSS 5.3 information leak plus a CVSS 6.1 privilege escalation plus a CVSS 4.8 sandbox escape individually pass any static CVSS-only filter; together they constitute remote code execution. Static prioritization is structurally blind to this. APD identifies the chain on every finding, every time. See the full Attack Path Discovery capability detail →

Yes. The same four configurable autonomy modes apply to vulnerability triage as to alert investigation. Level 1 (Deterministic): pure rule-based playbooks with no AI in the chain, for AI-prohibited tenants. Levels 2-3 (AI-Assisted / AI-Led): the AI proposes; the analyst approves at each command-risk tier. Level 4 (Autonomous): end-to-end execution under configurable approval gates.

For MSSP partners running heterogeneous client portfolios, the per-tenant autonomy configuration means the same Morpheus instance can run Level 1 vulnerability triage for a regulated finance client and Level 4 for a technology client simultaneously. See the autonomy modes detail →

No. Vulnerability triage is an extension of the same Morpheus platform: same engine, same integrations, same audit trail format, same operational model. No separate product. No separate audit trail. No second procurement decision. The capabilities that handle alert investigation handle vulnerability findings; the difference is the input format.

Morpheus AI uses a subscription pricing model: a Platform Subscription plus User Licenses. Talk to D3 about structure that fits your deployment model and autonomy configuration during the demo conversation.