Harnessing AI and proactive measures for effective management of vulnerability alerts

Recently I had the privilege of hosting a webinar where our very own CTO Matias Madou and with Mednd.io’s Sharon Kochevsky addressing Taking charge of vulnerability alerts. During the session they explored both the challenges and the solutions in handling security vulnerability alerts. In case you missed the webinar, here are a few key takeaways from their conversation. Of course, the webinar is also now on-demand here to get the full details. 

Impact of AI on security

Matias incorporated the analogy of self-driving cars to explain the current state of AI creating secure software. While self-driving cars can technically drive themselves they still face problems while on the road. For instance, he referenced one situation where self-driving cars encountered a problem on the road never encountered before and would ghost break as a result. Problems will come, and it’s the human technicians that need to resolve. Similarly, if developers blindly follow AI, errors in code and vulnerabilities could come into play.  

For AI to produce better output, Matias stressed the need for regularity and numerous good code examples to train developers on the AI models. While AI presently works well on generic frameworks, it falls short with real-world applications that operate on millions of code lines.

He further explained that seasoned developers could reap the benefits of generative AI for accelerated coding, but those not trained might pose a threat as they could reproduce and paste faulty codes at rapid pace. 

Shifting towards proactiveness

One topic that led the discussion was the shift towards proactive actions. Rather than keeping tabs on security issues, Sharon Kochevsky advocates for enterprises and AppSec programs to  take a more proactive approach with actual code fixes versus a reactive approach focused on security reporting. In line with Matias, he underscores the need to surpass purely administrative practices and focus on consequential outcomes. The panel also discussed primary areas of creating reports along with utilizing security products incorporated with real-time dashboards and issue tracking. 

Bridging the gap 

Sharon and Matias also identified a crucial problem that should get addressed: the disconnection between developers and security managers. Organizations and enterprises are now adding security champions to help bridge the gap. These are security pros located within the engineering team, and help promote proactive security measures.

Needless to say, we just scratched the surface on this topic and the conversation extends beyond these webinars; continuous discussion and engagement are crucial in our ever-evolving industry. If you would like to learn more or replay the session, it is now available on-demand.

‍