When AI finds bugs faster than humans can fix them
The U.S. Intelligence Community rethinks how to prioritize and remediate security flaws
Why it matters
- Attackers are using AI to find flaws at unprecedented speed
- Context separates critical threats from background noise
- Defenders need faster and smarter decision-making
The U.S. government is on the cusp of a daunting challenge: adversaries using advanced AI to find and exploit vulnerabilities buried deep within the software and networks national security relies on – faster and faster.
While these systems are highly protected, the underlying software often is the same as that used elsewhere around the world. Since AI coding assistants are exponentially faster and more capable of uncovering vulnerabilities, the cybersecurity approaches protecting sensitive systems must keep pace.
That’s extremely tough. Remediating vulnerabilities isn’t as simple as finding them, as they don’t exist in isolation. A bug can create risks specific to how agencies install and configure their software. Conversely, each agency has its own vulnerabilities depending on the programming languages and network architectures it uses.
As an agency figures out how to safely remediate vulnerabilities without affecting its systems, adversaries are using that time window to start exploiting them.
“Agentic tools in the hands of attackers could mean they will find zero-day vulnerabilities a lot easier,” said Nicholas Vidovich, a lead Leidos cyber software engineer. “These AI models can develop highly complex exploit chains. This is where the threat calculus will change.”
How AI is changing vulnerability management
Increasingly, vulnerability management operations, or VulnOps, are shifting from reactive and periodic to proactive and continuous because of AI.
With AI potentially digging up massive volumes of bugs, validating which ones need critical attention is key. A software or firmware bug in an endpoint device is more vulnerable than a similar bug in a centralized server.
“It’s like knowing an unlocked window on the second floor will be easier for a thief to reach than one on the 20th,” said Vidovich.
He, along with Leidos colleague Matthew Lehman, a principal security research scientist, recommends agencies adapt and scale their impact analysis and remediation on two fronts: the software development chain and the security operations center.
How Parcata™ prioritizes software vulnerabilities
Leidos is developing Parcata, a vulnerability analysis and decision tool that is designed to plug into typical software development workflows of teams shipping code and security teams governing the process. It uses a reconfigurable harness and a diverse set of large language models that work together to analyze source code and dependencies.
Compared with scanning tools focused on surfacing up known common vulnerabilities and exposures (CVEs), Parcata has its own discovery engines that work to hunt unknown vulnerabilities, along with reasoning capabilities that assess whether they matter and are reachable based on the agency’s specific environment.
Parcata is designed to run continuously within the software lifecycle and an organization’s own hardware and environment. It also complements other scanners agencies are using to find known CVEs, according to Vidovich.
Where agentic cybersecurity is going, we will have to move into a state of continuous vulnerability research for the entire software supply chain.
Nicholas Vidovich
Leidos Cyber Software Engineer
He says the Leidos-built harness is the engine behind Parcata, with tools and rules to prosecute code, test the pieces the LLM identifies as potentially vulnerable, and capture evidence of exploitability before producing patch recommendations. For maximum flexibility, agencies can swap LLMs in and out of the system.
Lehman adds that the tool is designed to work with models from the leading developers and cloud providers as well as open-source ones to give agencies a vendor-agnostic path to faster implementation and operational use.
Results arrive as context-based findings, with evidence including inputs that crashed the software, exploit demonstrations and “reachability traces” that show how attackers can potentially get to the vulnerabilities.
The tool lets users inspect the AI patch recommendations, audit their decision trails and override them if necessary.
Why human oversight still matters in AI cybersecurity
Vidovich and Lehman say autonomous cybersecurity for more sensitive systems in the U.S. government like the Intelligence Community (IC) should be bounded because of the potential high consequences. Unleashing AI on its own to fix flaws might sound quick and appealing, but classified or air-gapped networks are architected in ways that make patching risky due to creating unintended changes or new flaws.
Agencies should make sure they can dial up and down the human-to-agent balance of control in their toolsets.
“Certain types and classes of vulnerabilities should have more scrutiny with humans in the loop, whereas others may be minor in terms of their patches affecting the codebase,” said Vidovich.
“There’s an argument to be made with agentic code that there’s potential for vulnerabilities to be introduced into codebases without good hygiene,” Lehman added.
How upstream vulnerabilities create patching delays
Another challenge is the fact that much of the foundational code supporting the world’s IT infrastructure, including that used by the government and IC, comes from third parties. An open-source project might get patched within hours of a published CVE. But the update cycle for a software or hardware product can be several months long, creating a bottleneck for the patch to be distributed via a new release.
“Because of this upstream dependency, where we don’t have control, organizations will have to take other mitigations,” Vidovich said. “What can I do about this now?”
Without patches, countermeasures could be monitoring for network traffic anomalies, reducing the internet exposure of vulnerable areas, and doing network segmentation to contain the “blast radius” of any intrusion and compromise.
The onus is on agencies to have greater visibility of their software and hardware supply chains and ecosystem context, funnel up the highest-priority dangers, and figure out the best ways to address them. Agencies will still need human analysts and engineers to manage actions after what AI unearths.
Why vulnerability management must become continuous
Before AI, the rate of finding bugs was already exceeding the capacity to validate and fix them. Doubling down on the shift from velocity to better triage at deciding which ones matter most will be vital for agencies that don’t have big cybersecurity research teams, Lehman says.
“Where agentic cybersecurity is going, we will have to move into a state of continuous vulnerability research for the entire software supply chain,” Vidovich said.
Three things to remember
- AI is transforming vulnerability discovery for attackers and defenders alike.
2. Risk-based prioritization helps security teams focus on what matters most.
3. Continuous analysis helps the Intelligence Community respond faster to emerging threats.
