Beyond v4: An Autonomous Security Research Platform Orchestrating Multi-Stage Vulnerability Discovery Pipelines

We present Beyond v4, an autonomous security research platform that orchestrates multi-stage vulnerability discovery pipelines across 23 HackerOne programs. While SAIF (سيف) serves as a multi-expert cybersecurity analysis engine—detecting and classifying vulnerabilities through specialized 7B parameter language models—Beyond v4 is the orchestrator layer that manages the full discovery lifecycle: target rotation, subdomain reconnaissance, live host verification, DAST scanning, AI-driven enrichment, and structured report generation. Building on the SAIF architecture [1] and its field deployment results [2], Beyond v4 introduces a pipeline-as-a-platform abstraction that separates orchestration concerns from analysis execution. The system operates on a 2-hour cron cycle, processing 4-5 programs per rotation across 23 total targets. It integrates subfinder (passive reconnaissance), httpx (alive verification), nuclei (DAST scanning), and SAIF (LLM enrichment) into a unified pipeline with a structured findings/ output directory using JSONL format. We document the architectural separation between the orchestrator layer and the analysis engine, the pipeline stage model (recon → scan → analyze → report), the cron automation design with rate-limit-aware program rotation, and a quantitative comparison with semi-automated approaches showing a 12.7× improvement in subdomain discovery throughput and a 4.3× improvement in finding-to-submission ratio. Beyond v4 represents a shift from human-in-the-loop security research to autonomous, pipeline-driven vulnerability discovery on commodity hardware.