The Board Slide Hiding in Your Agent Telemetry
The measurements that earn an AI agent autonomy are the ones your CFO has been asking for. The quarterly security slide has looked the same for a decade. Vulnerabilities discovered: 14,000. Triaged: 9,200. SLA attainment: 94 percent. Every number on that page describes what the security team did. None of them describes what the business […]
Building an AI SDLC on Thin Ice: What Worked and What Backfired
Writing code was never the hard part of software engineering. That was true before LLMs and it’s still true now. The hard parts were always understanding the problem, choosing an approach you won’t regret in six months, and keeping a system comprehensible to the people who have to maintain it. Code was the mechanical part. […]
Your Agent Produced the Right Answer. It Still Did the Wrong Thing.
Introducing PolicyEval, the open-source library that scores AI agents against their policy, not just their output. The first two posts in the series (#1, #2) landed on something uncomfortable. AI coding assistants ship vulnerability patches that compile, pass tests, and still break production. Roughly one in five. The fix wasn’t a smarter model – it […]
OpenAI’s Aardvark: A Welcome Step Forward in AI-Driven Security, But Just the Beginning
RiskOn Thursday, OpenAI introduced Aardvark, their Security Research Agent designed to help developers and security teams discover and fix vulnerabilities at scale. As someone who’s spent the past year building AI remediation solutions at Backline, I found myself reflecting on what this announcement means for our industry. My reaction? Genuinely positive. This validates what we’ve […]
From Chaos to Confidence: Vulnerability Remediation With Guided AI
When I meet security leaders and engineering managers, I often hear the same concern about automation in remediation: “If we let an AI tool fix things automatically, how do we stay confident in the process?” This question isn’t theoretical; it plays out every day inside organizations. Security teams chase growing backlogs, SLAs loom, and regulators […]
Stop the whack-a-mole game: Turning npm Supply-Chain Chaos into Automated Remediation
In the span of a few weeks, the JavaScript ecosystem has been hit by back-to-back software supply-chain incidents. First came the s1ngularity/Nx compromise in late August. Then, this week, the Shai-Hulud campaign arrived with a twist: a self-replicating, worm-style payload that moved quickly through the npm ecosystem. Public write-ups from SCA and CNAPP vendors have […]
When AI Breaks Trust: The Problem with Unreliable Security Fixes
AI is infiltrating every corner of the software development lifecycle (SDLC), from code generating functions to generating entire test suites. These tools promise productivity boosts and reduced development time, but when it comes to critical tasks like fixing security vulnerabilities, many developers are hesitant to adopt AI-based solutions. In this blog, we unpack why developers […]
The Rise of AI Agents in Cybersecurity: Insights from RSA Conference 2025
RSA Conference 2025 in San Francisco confirmed that AI agents are rapidly transforming cybersecurity, moving from simple copilots to autonomous systems capable of executing complex, multi-step tasks. This shift is already reshaping how organizations detect, respond to, and manage cyber threats, but the journey toward full automation, where AI can not only identify but also […]
The State of Remediation: Why Security Backlogs Keep Growing
In the ever-evolving world of cybersecurity, organizations are facing an overwhelming challenge: the growing backlog of unresolved security findings. Despite advances in detection technologies, the gap between identifying security findings and remediating them continues to widen. Security Findings? Let’s define what we mean by Security Findings. Sometimes also referred to as vulnerabilities, these security findings […]