What Is an AI Gateway? Security Risks and Controls
What is an AI gateway? How it routes LLM requests, holds your keys and MCP tools, its top security risks (like Bifrost CVE-2026-90898), and how to lock it down.
Cybersecurity for fast-moving engineering teams.
We study how attacks are changing, then help you find, fix and prove what is wrong in the software you ship. Our research is public, so you can check our work.
ARGUS scans your repos and opens fixes as pull requests for your team to review. Free to start.
Trusted by
- OpenAI
- Anthropic
- Razorpay
Sutros- Hackitise Labs
FROM OUR RESEARCH
67.5%
of the 245 vulnerabilities CISA added to its Known Exploited Vulnerabilities catalog in 2025 would never have been tested before exploitation on an annual pentest schedule.
- 26 days
- median time from disclosure to exploitation
- 54%
- still missed with quarterly testing
Latest from Nexus Void
What Is CWE? Common Weakness Enumeration Explained
What is CWE (Common Weakness Enumeration)? How CWE differs from CVE, how the catalog and CWE Top 25 work, and why weakness types matter for prevention.
What Is JWT Authentication? JSON Web Token Security
What is JWT authentication? How JSON Web Tokens work, the top JWT vulnerabilities (alg none, algorithm confusion, CWE-347), and how to secure them.
Ubuntu snap-confine CVE-2026-8933: Local Root on Desktop
Ubuntu snap-confine flaw CVE-2026-8933 (CVSS 7.8) lets a local user win a race condition to gain root on default 24.04/25.10/26.04 desktops. Patch snapd now.
FortiMail CVE-2026-104286: Exploited Zero-Day File Write
FortiMail CVE-2026-104286 is a CVSS 9.8 unauthenticated arbitrary file write (path traversal), an exploited zero-day in CISA KEV. Affected versions and fix.
Dell CSM CVE-2026-63688: Root on Kubernetes Nodes
Dell CSM CVE-2026-63688 leads six critical flaws (two CVSS 10.0) giving unauthenticated admin and root on Kubernetes nodes. Patch to CSM 1.18.0 now.
WHAT ENGINEERING TEAMS ARE SAYING
“Most scanners gave us hundreds of dependency alerts and no way to rank them. ARGUS marks which ones are actually reachable from our code and scores them with EPSS and KEV, so we fix the few that matter first.”
ARGUS
Who is checking your AI‑written code before it ships?
ARGUS reviews every pull request, flags what is actually reachable and opens the fix for your team to approve. First findings in minutes.
Usage-based pricing, with a free tier to start.
- CodeSAST, dependencies and secrets in every repo
- APIsEvery entrypoint mapped to the data it can reach
- Cloud configTerraform, CloudFormation and Kubernetes
- Data storesWhich routes reach your databases, PII and credentials
- Third partiesThe services and AI APIs your code calls
- Attack pathsRanked chains an attacker, human or AI, could follow
Inside your AI coding tools via MCPClaude CodeCursorCodexand more
Findings go where your team worksSlackJiraLinear
FAQ
Frequently asked questions
Answers to the questions we hear most. Cannot find what you are looking for? Reach out.
Still have questions? Contact us
Nexus Void is a research-first cybersecurity company. We study how continuous verification, adversary simulation, and compliance evidence keep defenders ahead of AI-age attacks, and we publish the research behind it.
We lead with original work: computed analyses on public security data, reproducible experiments, and fast, sourced briefings on breaking threats. Every finding is labeled for exactly what it is.
Engineering-led companies that need enterprise-grade security outcomes without an enterprise security team, and anyone who wants verifiable security research rather than vendor marketing.
Four areas: continuous verification, supervised adversary simulation, compliance as evidence, and translating security posture into quantified risk.