Nuclei as a continuous attack surface check, not a one-off scan

Most vulnerability scanning is a quarterly event that produces a PDF. The problem with a quarterly event is that the exposure that matters appeared on a Tuesday in week three, and was exploited on the Thursday.

Nuclei changes that economics. It is a template-driven scanner, fast enough that a few thousand hosts against a few thousand templates finishes in minutes, which means you can run it nightly and only look at what changed.

Templates are the product

Nuclei itself is a request engine. What it does is defined entirely by YAML templates, and the community repository ships tens of thousands of them: known CVEs with a reliable remote signature, exposed panels, default credentials, misconfigurations, information disclosure, takeover-able DNS records.

Running all of them against everything is a mistake. Three problems: the noisy ones generate false positives that destroy trust in the tool, some are genuinely intrusive, and a handful of the community templates send payloads you would not want to send at a production system without reading them first.

We run a curated set:

nuclei -l targets.txt \
  -t http/cves/ -t http/exposed-panels/ -t http/misconfiguration/ \
  -t dns/ -t ssl/ \
  -severity critical,high,medium \
  -etags fuzz,dos,intrusive \
  -rl 50 -c 25 \
  -jsonl -o run-$(date +%F).jsonl

-etags fuzz,dos,intrusive is the important line. -rl and -c keep you from hammering the client's own rate limits and setting off their WAF.

Read the templates you enable at least once. A template is a file that describes requests to send to your production estate; treating it as opaque is the same mistake as curl | bash.

The target list is the other half

Nuclei only tests what you give it. The list has to come from discovery, and it has to be regenerated on every run, because the point is to catch new exposure.

A workable chain: subdomain enumeration from certificate transparency logs and the DNS provider, plus the public IPs pulled from every cloud account's API, resolved and probed for live HTTP services. ProjectDiscovery's own subfinder and httpx do this and hand off cleanly:

subfinder -d client.com -silent | httpx -silent -o live.txt

Add the cloud-derived IP list from your provider inventory and deduplicate. The assets that appear in the cloud list but not in DNS are the ones nobody is monitoring.

The diff is the alert

A nightly run that reports 340 findings every night is a nightly run that nobody reads. Compare each run against the previous one and alert only on what is new:

jq -r '[.host, .["template-id"]] | @tsv' run-today.jsonl | sort > today
comm -13 yesterday today > new-findings

A new finding means one of three things: a new asset appeared, an existing asset changed, or a new template was published for something you already had. All three are worth a human looking at them the same day. The stable 340 are a backlog to work through on a different schedule, not an alert.

Send the diff to the channel the on-call engineer actually reads. A Nuclei finding that lands in an email nobody opens is the same as no scan.

What it catches that other tooling does not

Subdomain takeover is the clearest case. A CNAME pointing at a decommissioned S3 bucket or a cancelled SaaS tenant is invisible to posture scanners, which look at what exists, not at what a DNS record points to that no longer exists. Nuclei's dns/ templates check exactly this, and takeover of a company subdomain is a genuinely serious finding: it breaks cookie scoping, OAuth redirect allowlists and every "we only send email from our own domain" assumption.

Exposed panels come second. Grafana, Jenkins, Kibana, Argo CD, phpMyAdmin, a printer's web interface — things that reach the internet through a well-meaning ingress rule and sit there with default credentials.

And the CVE templates are genuinely useful for the narrow window where a serious internet-facing vulnerability is published and you need to know within the hour whether you have it. When the next Confluence or Citrix or Fortinet bug lands, the template appears the same week, and one command tells you.

What it will not do

It will not find bugs in your own code. Templates match known signatures; your application's broken authorisation has no signature. Nuclei is a complement to an assessment, not a substitute — Burp and a person find the other half.

It will not rank by impact. An exposed Grafana with anonymous view on marketing dashboards and an exposed Grafana wired to the production Prometheus with an admin account are the same template ID.

And it will not tell you whether a finding is real. Verify by hand before it reaches a report or a ticket. Template quality varies, and a false positive delivered to a development team costs more credibility than the finding was worth.

Run nightly, alert on the diff, verify by hand, and the tool pays for itself the first time a subdomain goes stale. If you would rather have that set up and tuned for your estate, it is part of our security service.