> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef/frontier-defense.md). # Frontier Defense ## Overview Frontier Defense discovers and validates novel first-party vulnerabilities. It produces verified patches and remediation evidence. Lineaje Frontier Defense is an AI-native vulnerability engine. It discovers novel vulnerabilities, validates exploitability, generates compatible patches, and verifies remediation at scale. Frontier Defense adds an autonomous, multi-agent AI harness for first-party code. The harness uses multiple frontier AI models to assess Git repositories continuously. Frontier Defense runs inside the Continuous Vulnerability Elimination Factory (CVEF). It extends CVE Factory beyond known CVEs. It identifies, validates, and remediates novel first-party vulnerabilities, including zero-day risk.
### What Frontier Defense Does Frontier Defense combines purpose-built capabilities in one engine: * **Autonomous Agentic Vulnerability Harness** — Orchestrates isolated AI agents that discover vulnerabilities, generate exploits, validate findings, create verified patches, and confirm remediation. * **Model Selector** — Mixes commercial and open-source frontier models across repositories. Teams manage cost, governance, and flexibility. * **Novel Vulnerability Discovery** — Discovers vulnerabilities, determines severity, validates exploitability and runtime reachability, and confirms findings. * **Verified Exploit Generation** — Generates and safely detonates exploits in isolated sandboxes before remediation begins. * **Verified Patch Generation** — Produces deployment-ready patches. It replays the original exploit and rebuilds applications to confirm compatibility. * **Evidence-Backed Pull Requests** — Delivers review-ready pull requests with exploit evidence, verified patches, and remediation validation. * **Mission Control** — Maintains immutable lifecycle tracking for vulnerabilities, exploits, patches, and remediation progress. * **Flexible Deployment** — Supports SaaS, customer cloud, hybrid, and on-premises environments. * **Disclosure Management** — Maintains immutable evidence for disclosure, VEX, CSAF, and compliance workflows. ### Novel Vulnerability Identifiers: LVEs Every confirmed novel vulnerability receives a private Lineaje Vulnerability Enumeration (LVE). An LVE identifies a first-party vulnerability without a public CVE. It keeps the finding traceable through validation, remediation, disclosure, and audit workflows. The private disclosure pipeline tracks evidence for vulnerabilities, verified exploits, and patches. LVEs remain within your tenant. Lineaje does not share or disclose them on your behalf. You decide whether to correlate findings with public CVEs or use your disclosure process. ### How It Works Frontier Defense runs an autonomous Agentic Vulnerability Harness. Each step includes isolated sandboxes plus judge and verification agents. The harness can iterate up to five times per finding. Human approval is reserved for the final pull request. The harness applies Create, Judge, and Verify operations across three stages: Code, Exploit, and Gold FM Patch. These stages create nine isolated steps. They move each finding from hotspot discovery to a verified fix. #### Nine-Step Agentic Pipeline
**Discover and Validate Novel Vulnerabilities — Code** * **Vulnerability discovery** — Finds weaknesses and hotspots using threat modeling, AST analysis, and call-graph analysis. * **Finding triage** — Scores severity and drops false positives. * **Vulnerability confirmation** — Confirms runtime flaws and separates actual risk from theoretical findings. **Output:** AI-discovered vulnerabilities (LVEs) with context assessment, runtime verification, source model attribution, and evidence-backed prioritization. **Generate and Verify Exploits — Exploit** * **Exploit generation** — Builds proof-of-concept exploits in gVisor-based, network-isolated, single-use containers without egress. * **Impact assessment** — Rates exploitability and impact. * **Exploit reproduction** — Proves reliable reproduction. Instrumented crash validation confirms execution. **Output:** Reproducible exploit evidence, isolated sandbox execution, repeatability confirmation, and a complete evidence trail. **Patch, Verify, and Deliver — Gold FM Patch** * **Patch generation** — Writes a minimal source-code fix. * **Patch risk review** — Grades fix quality and checks for regressions. * **Verified remediation** — Reruns the original exploit in a separate sandbox. It certifies that the exploit remains closed. **Output:** AI-generated fixes, exploit replay, verified exploit closure, and review-ready changes. Frontier Defense delivers these as an evidence-backed pull request. A human approves the merge. ### Use Your Organization's Approved LLMs Frontier Defense supports approved commercial and open-source LLMs on supported platforms. Available models and platforms depend on deployment and governance requirements. ### Set Up Frontier Defense Start with [Configuration](/continuous-vulnerability-elimination-factory-cvef/frontier-defense/configuration.md). It covers repository connection, model selection, deployment requirements, access controls, and scan settings. Configure these settings before Frontier Defense runs scans or creates review-ready pull requests. ### Glossary * **LVE (Lineaje Vulnerability Enumeration)** — A private identifier for a novel vulnerability detection. It is the first-party counterpart to a public CVE. * **CVE (Common Vulnerabilities and Exposures)** — A public identifier for a disclosed vulnerability. It can apply to first-party products, open-source software, and third-party components. * **CWE (Common Weakness Enumeration)** — A software weakness category, such as a heap overflow or out-of-bounds read/write. It does not identify a specific vulnerability. * **CVEF (Continuous Vulnerability Elimination Factory)** — Lineaje's platform for Scan, Fix, Verify, and Deliver across OSS and first-party vulnerabilities. * **gVisor** — The sandboxing technology for exploit generation and patch verification. It uses isolated, single-use, network-isolated containers. * **VEX (Vulnerability Exploitability eXchange)** — A standard format for communicating whether a known vulnerability is exploitable in a product. * **CSAF (Common Security Advisory Framework)** — A machine-readable standard for publishing security advisories. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef/frontier-defense.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.