Quick answer: The value of a security tool is directly tied to how current its knowledge is. You cannot catch a CVE published today with yesterday's static vulnerability database. Three mechanisms keep KAOS current: first, a feed that pulls CVEs live according to the technology and version found on the target (a live NVD query, on by default); second, a memory that learns from and stores past scans and exploits (the brain/corpus); third, a generate-verify-learn loop that produces a new exploit, verifies it and writes the result to memory. This way KAOS recognizes known vulnerabilities as current, does not make the same mistake twice, and hunts n-day and variant vulnerabilities by synthesizing real exploitation from a CVE's patch.

The cyber threat landscape changes every day: new CVEs are published, new exploit techniques appear, new variants of old vulnerabilities emerge. A tool that works with a static vulnerability list starts going stale the day it is first used. The third core difference that lifts KAOS to a world standard is that it has a brain that keeps its knowledge live and learns on every run. This guide explains how KAOS uses live CVE intelligence, how its memory learns, and how the generate-verify-learn loop continuously strengthens it.

Live CVE intelligence: a current feed, not a static list

Most scanners work with a signature or vulnerability database updated periodically; a CVE published between two updates stays invisible. KAOS follows a different path: when technology and version are detected on a target, it queries the CVEs for that technology live. This live query is on by default, so KAOS is not limited to only the information in its own store but reaches current vulnerability records.

The power of this approach shows up on fresh vulnerabilities. A CVE published a week ago, not yet present in a static-database tool, can be recognized by KAOS through the live feed. In air-gapped environments, this live query is deliberately turned off and KAOS works only with its local knowledge; so in sovereign and offline scenarios no data leaks out either. We cover this offline capability separately in our KAOS sovereign and offline cyber intelligence article. You can find the general frame of threat intelligence in our cyber threat intelligence CTI guide.

Learning memory: not making the same mistake twice

KAOS's brain has a memory that carries from one run to the next. Every scan writes its observations, verified findings and working exploitation paths to a corpus. This memory is recalled as context in later scans: KAOS remembers which vulnerability turned out real on a technology before, which path was a false positive, and which exploitation worked.

This learning sharpens the tool over time. A language model starts from scratch every session; KAOS's brain accumulates. The memory stores not only successes but also eliminated false positives, so KAOS does not chase the same false trail over and over. This cumulative learning, combined with the proof-driven verification doctrine, creates a powerful effect: every verified finding speeds up a future scan, every eliminated claim reduces future noise. We cover the proof doctrine in our KAOS proof-driven verification article.

Generate-verify-learn: a loop that synthesizes exploits

One of KAOS's most advanced capabilities is a loop that not only recognizes a vulnerability but produces an exploit for it, verifies that exploit, and writes the result to memory. This loop consists of three steps:

Step Job Result
Generate synthesize a candidate exploit/PoC for the vulnerability a testable hypothesis
Verify run the exploit safely, produce proof real or not
Learn write the result (success/failure) to the corpus knowledge for the future

This loop lets KAOS synthesize real exploitation from a CVE's patch: it looks at the patch diff, derives the exact location of the vulnerability, and produces an exploit for it. The same logic is used to hunt new variants of a known vulnerability (n-day) and sometimes zero-day-like vulnerabilities not yet cataloged. We cover the general frame of variant hunting and automated exploit generation in our AI variant hunting n-day zero-day article and AI automated exploit generation AEG article. What makes KAOS strong is that it always ties this generation to verification; if the produced exploit cannot be proven, it does not turn into a claim.

Why a learning brain is a requirement of the world standard

In cybersecurity, staying static is falling behind. While the threat landscape changes daily, a tool whose knowledge is stuck in the past misses more vulnerabilities every day. KAOS's live intelligence, learning memory and generate-verify-learn loop turn it into a system that grows stronger over time instead of going stale. One of the features that defines a world-standard cyber intelligence is exactly this: getting a little better on every run.

The KAOS and DSET approach

At DSET we built KAOS's learning brain to be able to evaluate your organization against not only today's but also tomorrow's threats. In a scan we look not only for known vulnerabilities but also for fresh ones through live CVE intelligence and variant/n-day vulnerabilities through the generate-verify-learn loop; every exploitation claim is tied to verification, and unproven generation does not enter the report. In air-gapped organizations we run this intelligence entirely locally, with no data leaving. To evaluate your organization's posture against current threats with KAOS's learning brain, contact DSET and reach our team at Ankara Hacettepe Teknokent.

Frequently asked questions

Does the live CVE query put data privacy at risk? No, because this behavior is configurable. By default KAOS queries current CVE records according to the technology it detects; but in an air-gapped or sovereign installation this live query is turned off and KAOS works only with its local knowledge. So in sensitive environments no data leaves. You do not have to choose between being current and privacy; depending on the deployment scenario you get both.

What happens if the learning memory learns something wrong? KAOS's memory is tied to the proof-driven verification doctrine: a finding is written to memory as "verified" only if it has proof, while eliminated false positives are stored as "eliminated." This distinction prevents the memory from learning false positives as real. On the contrary, storing eliminated claims prevents KAOS from chasing the same false trail in the future and reduces noise.

Does the generate-verify-learn loop run real exploits? The loop runs the produced exploit safely and in a controlled way to verify it; the goal is not to harm the target but to prove the vulnerability is genuinely exploitable. If an exploit cannot be proven, it does not turn into a claim and this is written to memory as "did not work." So every loop, while producing proof, also accumulates knowledge for future scans.

Sources