AI moves Security Risks from Discovery to Operations

AI is discovering security vulnerabilities at lightning speed. The bottleneck shifted from problem detection and fixing to patch deployment in production environments.

In the past, developers reviewed thousands of lines of code or used SAST (Static Application Security Testing) or DAST (Dynamic Application Security Testing) Tools to discover vulnerabilities.

Today, AI Agents detect and fix these issues behind the scenes during the software development process, which is a tremendous improvement. For new systems, this works well, but the problem arises when we consider AI-detected vulnerabilities in operating systems or other critical business applications. If more of these issues are known and documented, adversaries can use the time between discovery and the actual deployment of a fix to carry out their malicious activities.

Are we heading toward a time when automated security fixes will be fully acceptable in enterprise environments?

Some solutions and operating systems already provide these automated update capabilities. My experience is that this is widely accepted in non-regulated environments. For mission-critical systems, automated patching remains too risky.

What might the future bring?

• AI to discover vulnerabilities

• AI to fix these issues

• AI to validate these fixes

• AI to calculate the risk score of this fix, and depending on the risk score

  • High risk --> Human approver to confirm the validated fix

  • Low risk --> AI to deploy the fix to production

To fully embrace the power of AI, the next natural step seems to be accepting automated security patch deployments in regulated, high-risk environments as well.

#Security #AI #Vulnerabilities