Your AI cybersecurity scanner just found a billion vulnerabilities. Now what?

Sponsored by

AI agents are starting to do more than access systems. They can invoke tools, execute workflows, and take action across business applications. As that autonomy grows, IT needs visibility into what each agent is allowed to do, what it actually did, who owns it, and how to revoke access when needed. Learn how JumpCloud helps govern AI agents alongside human and device identities.

The good news about an AI vulnerability scanner: It’ll likely find undiscovered vulnerabilities in your tech stack.

The bad news: It might find so many vulnerabilities that your organization will need to make some hard decisions about which fixes to prioritize.

Prioritization is the key to utilizing machine learning for security, said Chris Goettl, Ivanti VP of product security. But it requires making a case to executives that they should utilize AI in threat detection; enterprises may hesitate on that front out of fear of exposing sensitive data to a third-party vendor’s AI.

“That makes it difficult for detection, so I think opening up that ecosystem for the AI agent to be one more way of getting that deeper level of validation has been a benefit to the vulnerability detection space,” Goettl said.

Agentic detectors have been around for years. In 2024, researchers were using agents in sandboxes to red-team AI-driven exploitation. Today, AI scanners are growing in importance. Anthropic has a new product, OSS Scanner, that serves as an opt-in open-source vulnerability detector; OpenAI’s Codex Security fills the same function.

Next steps. Once you’ve managed to get the team on board, it’s a matter of deploying detection properly. AI can provide the raw information, but it’s humans who have to make the decision on what to make a priority. Lineage CEO Javed Hasan told IT Brew that determining exploitability is step one; step two is using the AI scanner to figure out the organization’s potential exposure to threats.

Often, threats and loopholes discovered by these scanners are so vast they require AI solutions to manage the volume. Enter frontier defense, Hasan said, a way to find the vulnerability and generate the fix.

“Autonomous fix is here or has to be here for this to work,” Hasan said. “If you don’t have an autonomous fix, I don’t think there’s a chance of being able to catch up in this new world.”

Eventually, the industry may reach the point where agents can make prioritization decisions themselves. But as Goettl pointed out, that will mean assessing what level of risk you can live with.

“Whether we keep the human in the loop or not on certain decisions all comes back to an organization having to define that risk appetite,” Goettl said. “They can infer those decisions down the road where AI should identify and flag humans for a decision, or be able to carry on and just execute based on the decisions that were already made.”