Security teams have a numbers problem. New software ships constantly, vulnerabilities pile up faster than people can review them, and attackers need only one mistake. A new group of startups, including firms such as Depthfirst, argue that artificial intelligence can speed up vulnerability hunting and help defenders keep pace. The claim is plausible, but the details deserve a careful look.
Where AI can help vulnerability hunting
Modern language models can read code, documentation and logs at a speed no human can match. In vulnerability hunting this has several uses. They can scan source code for patterns that resemble known flaws, explain what a suspicious function does, summarise a long alert and suggest a fix. They can also help triage, sorting a huge list of findings by likely importance.
The real promise is context. Traditional scanners match rules and often drown teams in false alarms. A model that understands how pieces of code fit together may recognise that a flagged issue cannot actually be reached, or that two minor problems combine into a serious one.
Consider a simple case. A developer adds a function that builds a database query from user input. A rule-based scanner may flag it just because of its shape, along with hundreds of similar lines. A context-aware system could trace where the input comes from, notice that it is already sanitised earlier, and say so, saving an hour of human attention. Multiply that by thousands of findings and the appeal of AI vulnerability hunting to overworked teams is obvious.
Where it falls short
Models make mistakes with confidence. They may report a vulnerability that does not exist, or miss one that does. Subtle logic errors, complicated authentication flows and flaws that span several services remain hard. Results can also vary from run to run.
Disclosure and ethics come into play too. A tool that finds flaws in other peoples software must handle that information responsibly, and customers should ask how findings are stored and who can see them.
That is why most serious vulnerability hunting products pair AI with traditional methods and human review. A useful system proves its findings, for instance by showing how an issue could be triggered, instead of just pointing. Evidence is what separates a helpful tool from a noisy one.
How defenders use AI for vulnerability hunting
Common workflows include:
- Reviewing code changes before they are merged, as an extra pair of eyes.
- Checking open-source dependencies for known weaknesses and judging whether they matter.
- Triage and ranking of scanner results.
- Drafting patches that engineers then review, much as AI coding assistants do.
- Helping analysts investigate alerts by gathering context, a theme covered in how AI helps security analysts cope with alert overload.
In each, the best pattern is AI proposing and a person deciding.
The arms race in vulnerability hunting
The same technology helps attackers. Models can speed up reconnaissance, craft convincing phishing and assist in finding flaws. Defenders therefore feel pressure to adopt similar tools simply to avoid falling behind.
It is tempting to see this as a dramatic duel, but the day-to-day reality is more mundane. Most breaches still come from basic failures such as weak passwords, unpatched systems and misconfigurations. Improving fundamentals often gives more protection than any new gadget.
Human skill still matters here. Traditional vulnerability hunting relied on experienced researchers who knew where programmers tend to slip: input handling, memory errors, access checks and sloppy defaults. AI tools learn some of those patterns from examples, but they do not carry a researcher’s instinct for what an attacker would find interesting. The best results come when a skilled person guides the tool, rejects weak leads and decides what is worth fixing first. Teams new to vulnerability hunting should treat the tool as a way to widen coverage, not as a replacement for judgement.
Culture matters as much as tools in vulnerability hunting. Developers adopt security checks they find helpful and bypass those that waste their time. Products that fit into the existing workflow, give short clear explanations and avoid crying wolf are the ones that actually get used. That is a product challenge as much as an AI challenge.
How to evaluate a vendor
Ask for a trial on your own code, since demos on neat examples prove little. Measure false positives and missed issues against a sample you know. Ask where your code goes: is it sent to a third party, stored, or used for training? Check the access it requires, because a security tool with broad permissions is itself a target.
Also ask how the vendor handles the model’s mistakes and how it keeps up as the underlying technology changes. A startup’s funding announcement tells you it has money, not that it has solved the problem.
AI will probably become a normal part of vulnerability hunting and wider security work, much as automated scanners did before it. The teams who benefit most will treat it as a capable assistant, verify its output, and keep investing in the unglamorous basics. That combination is less exciting than a headline, and considerably harder to break.
