⛨
Pentest finding triage
SecurityTriage a VAPT / pentest finding into CVSS-style severity, exploitability, business impact, step-by-step remediation, owner and SLA — false-positive flag included.
The routing recipe
Job typeComplex reasoningPolicyBalanced
routes to
NVIDIA Nemotron 3 Ultra 550B-A55B nvidia
nvidia:nvidia/nemotron-3-ultra-550b-a55b
90.8
match score
96.5
task fit
100
cost
59.5
speed
Why this model from benchmarks & capabilities
- "Complex reasoning" leans hardest on reasoning; NVIDIA Nemotron 3 Ultra 550B-A55B scores 100/100 there — top-1 of 40 chat models.
- Strength on this class of work shows up on GPQA Diamond, MMLU-Pro, BIG-Bench Hard, where NVIDIA models are competitive.
- Cost: runs on NVIDIA free credits / self-hostable NIM — effectively $0 marginal. Speed: ~70 tok/s (estimated).
- Chosen over NVIDIA Nemotron 3 Super 120B-A12B for higher task-fit (96.5 vs 90.7) & more context.
| Capability the job needs | Weight | NVIDIA Nemotron 3 Ultra 550B-A55B | Catalog rank |
|---|---|---|---|
| reasoning | 1.00 | #1 of 40 | |
| math | 0.60 | #3 of 40 | |
| knowledge | 0.50 | #4 of 40 |
Relevant benchmarksGPQA Diamond MMLU-Pro BIG-Bench Hard LiveBench (reasoning)
EconomicsCost: runs on NVIDIA free credits / self-hostable NIM — effectively $0 marginal.
Speed: ~70 tok/s (estimated). vs runner-upChosen over NVIDIA Nemotron 3 Super 120B-A12B for higher task-fit (96.5 vs 90.7) & more context. (NVIDIA Nemotron 3 Super 120B-A12B, score 89.5)
Speed: ~70 tok/s (estimated). vs runner-upChosen over NVIDIA Nemotron 3 Super 120B-A12B for higher task-fit (96.5 vs 90.7) & more context. (NVIDIA Nemotron 3 Super 120B-A12B, score 89.5)
Example result
Sample input ▾
Reflected XSS on /search?q= — the q parameter is echoed unescaped into the results <h2>. No Content-Security-Policy. Authentication not required. Found with Burp.
Severity: High — CVSS 3.1 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)
Exploitability: Realistic — unauthenticated, single crafted link; no CSP to blunt it.
Affected: Public search page; any logged-in victim who clicks the link.
Impact: Session/token theft, account takeover, defacement.
Remediation: 1) Context-encode q on output (HTML-escape). 2) Add CSP `default-src 'self'`. 3) Set HttpOnly+SameSite on session cookies. 4) Add a regression test with a `<script>` payload.
Owner: Web team. SLA: 30 days. False positive: No — reproduced.
Test it on your own data