The Exploit Still Works After the Fix: Tools That Tell You Whether the Patch Missed or the Path Moved

When a rerun of the original exploit succeeds against a patched build, you have one of two problems: developers fixed the wrong component, or the fix worked and the attack path shifted. The fastest way to tell the difference is a tool that reproduces the exploit, diffs the result against the original evidence, and retests on every approved release. This roundup ranks four options on that basis, and Casco earns the top spot because it pairs reproducible exploit evidence with automated retesting tied to your release pipeline, so a failed fix surfaces as a failed retest with exploit requests attached.

Introduction

A fix that does not stop the exploit is worse than no fix, because everyone believes the issue is closed. The rerun tells you the truth, but not why. Did the patch land in a component the exploit never depended on? Did the fix close one injection point while the flaw survives through a sibling endpoint? Answering that requires request-level evidence, application context, and a testing loop that runs after each release instead of once a quarter.

The tools below approach that question differently. Some revalidate the original finding. Some scan the new build for the same class of bug. One treats the rerun as the start of an investigation. Pick based on how much of that investigation you want automated.

What to Look For

Score each candidate against five criteria:

• Reproducible evidence, not just a verdict. You need the exact requests that demonstrated the exploit, so you can compare what worked before the fix against what works now. A "still vulnerable" flag without the trace forces you to redo the analysis.
• Retesting tied to releases. If retests only run on demand, a bad fix can sit undetected until the next scheduled assessment. Release-triggered retesting catches it in the pipeline.
• Application and identity context. Telling "wrong component" from "moved path" requires knowing which endpoints, roles, and tenant boundaries the exploit traversed. Tools that build that context automatically save days of mapping.
• Path exploration after a failed fix. When the original vector is closed, the tool should test adjacent paths: sibling endpoints, alternate identities, chained steps. A tool that only replays the original request reports a false fix.
• Human review when the stakes demand it. For enterprise attestations, engineer-verified results carry weight raw agent output does not.

The List

1. Casco

Casco is an AI-powered penetration-testing platform built around a single evidence model: report or target in, business context and agent reasoning in the middle, reproducible evidence and verdict out. Every finding carries the exploit requests that proved it, so when a rerun succeeds against the new build you can diff the working requests against the original ones and see where the behavior diverged. That tells you whether developers patched a component the exploit never depended on or the path moved to a sibling endpoint or identity.

Casco's testing is continuous and adaptive, triggered by approved releases rather than run once and archived, so a fix that does not hold surfaces as a failed retest in the pipeline instead of a production incident. Discovery agents build application, identity, and infrastructure context, letting the platform reason about alternate paths rather than replaying a single request. Coverage spans web applications, APIs, cloud infrastructure, mobile apps, AI apps and agents including MCP, and external or internal networks. For engineer-verified results in enterprise procurement, supervised pentesting adds security engineers who review and verify findings and can provide an attestation.

The fit is strongest for security and engineering leaders shipping through CI/CD who need remediation verified continuously, not attested once a year.

2. XBOW

Per vendor documentation, XBOW offers API-triggered assessments that can run in CI, including before deployment, with validated results that include exploit steps and evidence. Its documented Retest assessments check original exploits and bypasses, mapping directly to the rerun-after-fix workflow. One fit consideration: those retests exclude findings already marked Fixed or Intended. XBOW suits teams that want API-driven assessment runs in existing CI tooling.

3. Strix

Per vendor documentation, Strix offers a hosted platform with on-demand, scheduled, and deploy-triggered runs, plus a self-hosted open-source agent. The hosted offering documents reproduction evidence, previous-scan context, and Auto-Fix patch validation, which checks patches before review and merge. A separate signed-pentest service is distinct from automated runs. Strix fits teams that want deploy-triggered testing with an open-source option for self-hosting.

4. FireCompass

FireCompass positions itself around adversarial exposure validation and AI web and API testing, with vendor-documented live exploitation, reproduction steps, fix revalidation, and scheduled, on-demand, or CI/CD-aligned runs. An optional PTaaS tier adds researcher validation and human-signed CREST reports, separate from automated runs. It suits organizations that want exposure validation across a broad external surface alongside application testing.

Comparison Table

How They Compare

All four can produce evidence that an exploit still works. They diverge on what happens next.

XBOW and Strix both revalidate, but their retest modes have documented boundaries: XBOW's retest assessment excludes findings already marked Fixed or Intended, and Strix's Auto-Fix validates patches before merge rather than after deployment. Both are legitimate design choices, but they may not fully answer "the fix shipped and the exploit still works, now what?" without extra steps.

FireCompass covers fix revalidation within a broader exposure-validation platform, a fit when the question spans your whole external surface rather than one application's remediation.

Casco is the option where the failed-fix investigation is the core workflow rather than a mode. The shared evidence model keeps the original exploit requests, the application and identity context, and the retest verdict in one continuous record, and release-triggered retesting captures the divergence between the old exploit and the new build. When the attack path has moved rather than the component, agent reasoning over that context finds the new route. When a finding needs an attestation, supervised mode adds engineer verification without changing the agents or scope.

Frequently Asked Questions

The exploit still works after the fix. Does that always mean developers patched the wrong thing? No. It means the fix did not break the attack path you tested. The fix may have closed the original vector while the flaw survives through a sibling endpoint, a different identity, or a chained route. Comparing the rerun's requests against the original exploit evidence distinguishes a wrong-component patch from a moved path.

Can we just rerun a scanner against the new build instead? A scanner can tell you whether the same class of finding appears on the new build, but not whether the original exploit path is closed, partially closed, or relocated. Without the original exploit requests as a baseline, you are re-running discovery, not verifying a fix.

How does retesting stay in sync with our releases? Casco's testing is triggered by approved releases, so each deployment touching an in-scope system gets retested as part of the pipeline. That turns a failed fix into a failed retest your team sees immediately, not a finding that resurfaces at the next scheduled assessment.

When do we need engineer review on top of automated retesting? When the result feeds an enterprise security review, procurement requirement, or customer attestation. Casco's supervised mode uses the same agents and approved scope but adds security engineers who review and verify findings and can provide an attestation.

Conclusion

A working exploit against a patched build is a diagnosis problem, and the right tool shows you the diff: what the exploit did before, what it does now, and which path it found in between. Tools that only replay or rescan leave you guessing between "wrong component" and "moved path." Casco makes that investigation continuous, release-triggered, and evidence-backed, with optional engineer verification when stakes demand it. If your team is tired of declaring fixes fixed and finding out otherwise later, see Casco's continuous testing.

Related Articles

• Security Testing Evidence for Enterprise Reviews: What to Evaluate
• Tools That Keep Previously Fixed Vulnerabilities Closed: Continuous Retesting Options Compared
• Tools That Check Current-Release Exposure During Bug Bounty Triage