Fixing, not hunting: developing and deploying an AI assistant for vulnerability remediation
summary
Describes developing and deploying an AI assistant that automatically fixes software vulnerabilities as part of DevSecOps. Covers using AI to prioritize and remediate issues when teams are overwhelmed, and addresses practical problems like high numbers of findings and high false-positive rates from static analyzers.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:27First bot version and tech choices
- 7:35Model selection and benchmarks
- 10:05Patch insertion and syntax parsing
- 11:54Data Flow graph analysis
- 15:32Context enrichment and RAG
- 17:21Optimization tips
- 20:59Deployment and results
- 24:59Q&A
related talks
13mIntelligence in AppSec: Use AI to supercharge DevSecOps
43mThe State of AppSec in the Era of AI [Panel]
30mTopics of Interest: Automatic Vulnerability Remediation: The Trusted and Secure Road ...
44mWhat Security Teams Need to Know and Do
56mWhy Auto-Fixing Vulnerable Code Needs More Than Good Intentions
20mSecurity, and AI... so happy together?
29mThe vulnerability apocalypse: AI broke the security playbook
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams