Bug Bounty Reconnaissance Acceleration
An independent security researcher participates in bug bounty programs on platforms like HackerOne and Bugcrowd. They target large-scope programs where the attack surface includes hundreds of subdomains, APIs, and legacy applications. Reconnaissance alone subdomain enumeration, port scanning, technology fingerprinting, content discovery consumes 60-70% of their total hunting time.
Run on Vedha · Security & Assurance
The challenge
Large-scope programs require extensive reconnaissance before any vulnerability testing can begin.
The researcher works alone and competes against teams and automated tooling speed is a decisive advantage.
Manually chaining recon tools ('subfinder' → 'httpx' → 'nmap' → 'nuclei' → 'ffuf') is tedious and error-prone.
How Vedha solves it
Goal-Oriented Recon
The researcher starts a Flow with the goal: "Perform full-scope reconnaissance on example.com. Enumerate subdomains, identify live hosts, fingerprint technologies, discover hidden endpoints, and flag high-value targets for manual testing."
Autonomous Tool Chaining
VEDHA's agents autonomously chain together the recon workflow. The Installer Agent ensures 'subfinder', 'httpx', and 'nuclei' are available in the sandbox container. The Primary Agent runs subdomain enumeration, pipes results into HTTP probing, and then runs targeted 'nmap' scans on interesting hosts all without manual intervention.
Knowledge Graph as Recon Database
Every discovered subdomain, IP address, open port, technology stack, and interesting endpoint is stored as entities and relationships in the Neo4j knowledge graph. The researcher can later query this graph to find, for example, all hosts running WordPress with an exposed 'xmlrpc.php'.
Persistent Memory Across Sessions
If the researcher runs a second Flow days later targeting a specific subdomain discovered in the first run, VEDHA's pgvector semantic memory retains findings from the previous session. The agents don't repeat work they build on existing knowledge.
Coder Agent for Custom Tooling
When the researcher notices a pattern in the target's API responses, they ask VEDHA to write a custom Python script to test for a specific edge case. The Coder Agent generates the script, the Primary Agent executes it in the sandbox, and the result is logged and stored.
The outcome
- reconnaissance that previously took 2
- 0 daysreconnaissance that previously took 2
- structured knowledge graph output reveals a forgotten staging
- $0structured knowledge graph output reveals a forgotten staging
Reconnaissance that previously took 2-3 days of manual effort is completed in 4-6 hours.
The structured knowledge graph output reveals a forgotten staging subdomain ('staging-api.example.com') with an exposed admin panel leading to a $5,000 bounty.
The researcher's efficiency improvement allows them to participate in 3× more bounty programs per month.
Representative scenario: a modelled industry situation showing how this accelerator applies. Figures are projections, not a named client result.
Capabilities used
Every accelerator is assembled from the same capability layer, so a workflow you adopt here shares its foundation with the rest of the portfolio.
More from Vedha
Safety & Security
Continuous Security for a Fast-Moving SaaS Startup
A Series-B SaaS startup ships product updates multiple times per week. Their engineering team of 40 developers deploys microservices across AWS ECS, but they have only one part-time security engineer. Manual penetration tests are performed once a quarter by an external vendor, costing $15,000-$25,000 per engagement, and the reports arrive weeks after the code has already changed.
Safety & Security
Pre-Compliance Penetration Testing for a Healthcare Platform
A digital health company building an electronic health records (EHR) platform must satisfy HIPAA security requirements before launching. Their compliance officer needs evidence of penetration testing to include in the security risk assessment. The company's infrastructure includes a React frontend, a Node.js/Express API, a PostgreSQL database, and an S3 bucket storing patient documents.
Safety & Security
Red Team Simulation for a Financial Institution
A mid-size bank with 2,000 employees conducts annual red team exercises as part of its cybersecurity maturity program. The internal red team consists of three senior security engineers who manually simulate adversary tactics across the bank's external-facing infrastructure: internet banking portals, mobile API gateways, and partner integration endpoints. Each exercise takes 4-6 weeks.
Bring us the version of this that you actually have.
Every engagement is fixed-scope and outcome-guaranteed. The scoping conversation starts with your systems, not with a template.