Jimmy White, Chief Technology Officer, AI Security, F5

The first domino has well and truly fallen. The advent of high-powered AI models that can rapidly find software vulnerabilities that have lain hidden – in some cases, for decades – effectively makes static code analysis the first significant problem to be solved by AI.

The first-, second-, and even third-order effects of models such as Anthropic’s Claude Mythos Preview and ChatGPT 5.4-Cyber by OpenAI are the hottest topic in enterprises globally, for good reason. By pairing powerful AI with huge volumes of code data and existing vulnerability databases, these models know what good and bad code looks like, and can cycle through code at machine speed to find bugs and security issues.

Put simply, there has never been anything better than these AI models at detecting vulnerabilities in source code; they are highly capable tools that outperform all current best-in-class solutions. Their ability equates to a human coder that knows every existing disclosed software flaw, can read as fast as a computer, has perfect memory, and has 100% recall in milliseconds.

The potential and limitations of frontier models

There are already countless examples of the models finding real-world software vulnerabilities that have lain dormant for long periods but never known. There are also likely to be flaws that are unknown to their host company but are being abused by threat actors behind the scenes – a known tactic of attackers who want to keep their best weapons under wraps.

Most recently, there are eye-opening incidences of test models chaining together attacks or breaking their boundaries, such as the OpenAI models that accessed Hugging Face from a sandbox environment. Anthropic is investigating three incidents where Claude test models accessed the internet and breached the systems of outside organisations.

What does it all mean for already-stretched IT security teams and the industry as a whole? First, the utopian scenario: organisations with access to these models can rapidly find all the vulnerabilities in their existing code base and go about fixing them, reaching a better security posture. At the same time, all their new code can go through the models, so there is no ‘bad’ new code, no new security vulnerabilities.

Enterprises can also apply the models at all the entry points for potentially harmful code into their organisation. Any open source tools can be checked before usage; in M&A scenarios, acquirers can insist on the code base of potential acquisitions going through the AI models; companies can evaluate the source code of vendors that want their business; and so on.

However, the utopian thesis quickly breaks, for two reasons. One is that the AI models are performing static code analysis. Yes, that’s a very big, important thing, but it’s not everything; there are still many flaws that AI can’t find because it can’t understand the patterns in runtime or race conditions.

Secondly, and maybe more importantly, because AI makes coding easier, enterprises around the world will undoubtedly be generating exponentially more new code. Google says that 75% of its new code is AI generated; at Anthropic and other AI-native companies, the proportion is as high as 90%. So, the speed that new code – and new vulnerabilities – are being created will at least match the speed these powerful models can find those vulnerabilities.

Static code analysis is just the opening act

For now, access to frontier AI models is limited, allowing participating organisations to find and fix bugs before they can be exploited in anger. But the frontier model companies have been frank that these models present unprecedented attack capability, as demonstrated in the Hugging Face incident, making them dangerous in the hands of a bad actor.

This is a familiar pattern in AI: each time the technology catches up from a cyber defence perspective, it offers similar advancements from an offensive perspective. As an industry, we are in an established cycle of ‘leap ahead, catch up’, a game of leapfrog between defenders and attackers as both sides advance their capabilities.

For the AI model makers, there is another aspect to the story. Source coding itself looked set to be the first market to be ‘cracked’ by AI, but it remains imperfect and still requires human input and oversight. In static code analysis, the frontier model companies have found a market they can dominate, defying the naysayers who question the enormous investment in AI and the technology itself.

Anthropic was first to this particular market, but OpenAI and other frontier model companies were quickly out of the blocks. Open-source models will similarly reach the bar for effective code vulnerability scanning, sooner rather than later.

Other markets will follow too. Anthropic’s collaboration with Canva, the design software company, and the launch of Claude Design signal is another example of a market that will be disrupted by the application of powerful AI to existing practices.

The AI giants are becoming surgeons, not general practitioners

In the Western world, there are now five titans in the AI arena: Anthropic, OpenAI, Google, Meta and xAI. They are going toe-to-toe with regular improvements in their models, opening up the prospect of a new class of specialised AI models for specific tasks that have practical – and financial – value.

Each time one of these players picks a new thing to focus on, it is a signal to where there’s market value. Sometimes they will choose the same market, but sometimes they will go for unique ones, maybe niche to their business area.

What those markets are will partly be decided by the model companies’ access to relevant datasets. Because of the popularity of its models with coders, for instance, Anthropic had access to an enviable source code dataset for training Mythos Preview.

Meta and xAI have access to vast social and communication data, though the nature of their data is very different. On top of that, search, email and mapping services hold near-infinite amounts of data on how people communicate and where they go.

This is all ripe for disruption by AI, with profound downstream effects. For example, enterprises may be discouraged from choosing a single AI provider as various model makers offer increasingly differentiated capabilities.

Buyers will benefit from competitive tension, but the cost and complexity of maintaining and securing multiple AI models will rise. Enterprises will have multiple subscriptions with multiple providers for different use cases.

AI disruption has only just begun

The static code analysis breakthrough did not happen by accident. The frontier model companies have pointed their currently most powerful models at a 20-year-old problem where they have the training data – and the models perform very well.

They will point the models at hundreds of other 20-year-old problems and do equally well. For the foreseeable future, we can expect massive disruption. This is the first domino to fall; there will be another, and another, and another.

The post The first domino of AI disruption: How frontier models are revolutionising software security appeared first on IT Security Guru.

By Simon Phillips, CTO, CybaVerse

Alert fatigue is an issue that has plagued Security Operations Centres for years.

As organisations’ digital estates grow, there is more architecture to secure and more architecture for threat actors to attack, which has ultimately led to more alerts.

Today, on average a SOC will face thousands of alerts every day, each of which could indicate a potential threat. Each alert must therefore be analysed and investigated before appropriate action can be taken.

However, ask any SOC analyst and they will tell you the majority of these alerts are benign or false positives.

Yet, analysts will still spend hours investigating activity that ultimately poses little or no risk, hoping to identify the small number of genuine threats hidden amongst the noise.

Given the volume they face, and the possibility of missing something before it’s too late, it’s a noisy, high-stress environment that often leads to burnout and fatigue.

To tackle these issues, many SOCs today are turning to Artificial Intelligence (AI) to support the management of alerts.

In this scenario, the first-line analyst is replaced by an agent that reviews the incident to determine whether it’s malicious and if further action is required. The analyst must then review the conclusion reached by the agent to ensure it is accurate, but they don’t conduct the initial investigations themselves, which reduces the volume of alerts they have to investigate every day.

However, even despite these improvements, is there another way that could reduce the noise even further?

If organisations are still generating huge numbers of unnecessary alerts, have they actually solved the underlying problem, or simply moved it further downstream?

Moving AI upstream

Instead of asking AI to investigate incidents after they have been created, some organisations are using the technology much earlier in the detection process.

Rather than having AI decide whether an alert is malicious, in this scenario it’s used to help build better detection logic and more effective workflows before alerts ever reach an analyst.

For instance, in a phishing attack when an employee reports an email as suspicious, many security platforms immediately generate an incident that someone must investigate.

Traditionally, either a human analyst or an AI assistant would then collect additional context, checking whether links have been clicked, whether anyone else received the email, or whether similar activity appeared elsewhere in the environment.

If these types of checks are incorporated into the detection process, and the answers to the questions are no, then an incident would never need to be created in the first place.

The AI would determine that there was no wider threat, meaning the alert could be filtered out before it ended up in the SOC ticket queue.

The result is a faster, more efficient SOC, with far fewer unnecessary alerts reaching analysts.

From a customer perspective, this can also reduce the costs of working with an outsourced SOC partner.

Many AI-powered investigation platforms price their services according to the number of alerts they process, so reducing unnecessary alerts before they reach the investigation stage can improve efficiency while also helping organisations control operational costs.

Improving security through engineering

Another benefit of moving AI further upstream is that it limits access to sensitive customer data.

Many AI-driven investigation platforms analyse real customer logs and incident data to determine whether activity is malicious. While providers implement safeguards, some organisations are uncomfortable with sensitive operational data being processed by external AI systems, particularly where regulatory or contractual obligations apply.

Using AI during detection engineering changes this process. The AI is used to create the logic that identifies threats, not to inspect live customer data.

Once the detection rules have been verified, they can be applied consistently across customer environments without repeatedly sending operational data through AI models.

Solving the cause, not the symptom

The cyber security industry has become very good at handling alert fatigue, but not so good at preventing it. Is it time a different approach was adopted?

If security teams continue generating thousands of low-value alerts every day, replacing analysts with AI may improve efficiency, but it won’t address why the alerts exist in the first place.

As AI becomes more deeply embedded within security operations, organisations should consider where it delivers the greatest value. In many cases, the answer may not be at the point where analysts investigate incidents, but much earlier, where better detection engineering prevents unnecessary incidents from being created at all.

By reducing false positives at the source, this allows analysts to spend more time on genuine threats, while improving consistency, cutting costs and helping organisations make better use of both their technology and their people.

The post Is AI entering the SOC at the right stage? appeared first on IT Security Guru.