AI Is Moving From Finding Bugs to Fixing Them

For twenty years we built better smoke detectors. Now we are finally building firefighters.

We have gotten incredibly good at finding problems.

Your IDE underlines a vulnerability before you finish typing it. Your CI pipeline fails because a transitive dependency three levels deep has a CVE from 2019. Your inbox gets a Dependabot PR every Tuesday that you will politely ignore until Thursday. GitHub Advanced Security, Snyk, Semgrep, Wiz, Orca, Lacework, the alphabet soup of scanners has turned security into a very high resolution photograph of a burning building.

We know exactly where the fire is. We have a heat map. We have a severity score. We have a CVSS vector that nobody reads.

We just do not put it out.