Your Agent Produced the Right Answer. It Still Did the Wrong Thing.
Introducing PolicyEval, the open-source library that scores AI agents against their policy, not just their output. The first two posts in the series (#1, #2) landed on something uncomfortable. AI coding assistants ship vulnerability patches that compile, pass tests, and still break production. Roughly one in five. The fix wasn’t a smarter model – it […]
Shrink the Exposure Pile: Vulnerability Management in the Age of Vibe Coding
Part 1 of a two-part series. Security teams already own more scanners, exposure platforms, and dashboards than they can act on, yet the vulnerability backlog grows every week. The bottleneck has moved downstream, from finding vulnerabilities to remediating them, and AI-generated code widens that gap faster than any hiring plan can close it. On a […]
Your AI Patches Still Break Production? The Fix Isn’t a Better Model, It’s a Better Workflow.
In our previous post, we showed how general-purpose AI coding assistants produce vulnerability patches that compile, pass tests, and still break production. The data was clear: a persistent ~20% defect rate across compatibility, correctness, and precision – not because the models can’t code, but because they skip the critical step of understanding the APIs deltas. […]
From Chaos to Confidence: Vulnerability Remediation With Guided AI
When I meet security leaders and engineering managers, I often hear the same concern about automation in remediation: “If we let an AI tool fix things automatically, how do we stay confident in the process?” This question isn’t theoretical; it plays out every day inside organizations. Security teams chase growing backlogs, SLAs loom, and regulators […]
When AI Breaks Trust: The Problem with Unreliable Security Fixes
AI is infiltrating every corner of the software development lifecycle (SDLC), from code generating functions to generating entire test suites. These tools promise productivity boosts and reduced development time, but when it comes to critical tasks like fixing security vulnerabilities, many developers are hesitant to adopt AI-based solutions. In this blog, we unpack why developers […]
The Rise of AI Agents in Cybersecurity: Insights from RSA Conference 2025
RSA Conference 2025 in San Francisco confirmed that AI agents are rapidly transforming cybersecurity, moving from simple copilots to autonomous systems capable of executing complex, multi-step tasks. This shift is already reshaping how organizations detect, respond to, and manage cyber threats, but the journey toward full automation, where AI can not only identify but also […]
The State of Remediation: Why Security Backlogs Keep Growing
In the ever-evolving world of cybersecurity, organizations are facing an overwhelming challenge: the growing backlog of unresolved security findings. Despite advances in detection technologies, the gap between identifying security findings and remediating them continues to widen. Security Findings? Let’s define what we mean by Security Findings. Sometimes also referred to as vulnerabilities, these security findings […]