Ivanti Explores LLMs for Automated Vulnerability Remediation
Ivanti is piloting the use of large language models to automate the identification and remediation of software vulnerabilities, aiming to accelerate patching and improve security.
Ivanti, a vendor known for its enterprise automation and security solutions, is venturing into the burgeoning field of artificial intelligence for cybersecurity operations. The company is actively exploring the use of large language models (LLMs) to automate the complex and time-consuming process of vulnerability remediation. This initiative aims to not only speed up the patching cycle but also to identify vulnerabilities that might elude traditional security tools.
This exploration was spurred by early successes and a growing recognition of LLMs' potential beyond simple code development. Ivanti's Chief Security Officer, Daniel Spicer, revealed that the project began in late February, with internal teams experimenting with advanced models like Anthropic's Claude. The dual-track approach focused on two key areas: enhancing the ability of red teams to find novel vulnerabilities and, crucially, automating the resolution of identified weaknesses.
The genesis of the project involved recognizing the advanced capabilities of contemporary LLMs. Spicer noted that the "4.6 generation of models for Claude are actually pretty good," prompting the team to investigate their application in security. This led to the establishment of an internal project combining engineering and security expertise. One track focused on automatically resolving vulnerabilities, while the other aimed to discover flaws that traditional tooling might miss.
One of the most striking aspects of Ivanti's initiative is the potential for LLMs to not only find but also fix vulnerabilities. While SAST and DAST tools identify weaknesses, determining if a weakness constitutes an exploitable vulnerability often requires human analysis. Ivanti's goal is to use LLMs to automatically address these identified weaknesses before they can be exploited, thereby reducing the burden on engineers and accelerating the remediation process.
Spicer expressed pleasant surprise at the early results, indicating success with both Anthropic and OpenAI models. The company is employing a combination of frontier and internally-run open-source models. The strategy involves categorizing vulnerabilities by CWE (Common Weakness Enumeration) and crafting specific prompts to generate high-quality fixes. The ultimate vision is to integrate this process into an automated agent that can detect a CWE, fix it, and resubmit the code for re-testing.
While the full scope of vulnerabilities found and fixed is yet to be disclosed, Ivanti plans to release research findings in the coming months. The company is gradually moving from low-complexity CWEs to more complex ones, with a high success rate in generating fixes. These fixes are being applied to vulnerabilities missed by traditional SAST tools, as well as those created in a lab environment to test the LLM's efficacy.
Despite the potential for AI agents to go awry, Ivanti's team approached the project with a pragmatic outlook rather than trepidation. The focus is on building robust processes and guardrails. The long-term objective, as Spicer hinted, could eventually lead to a scenario where human engineers are less involved in the routine remediation of certain types of vulnerabilities, allowing them to focus on more complex security challenges.
This move by Ivanti highlights a significant trend in the cybersecurity industry: the increasing adoption of AI for proactive defense. As threat actors leverage AI for offensive purposes, vendors are exploring AI-driven solutions to bolster their security postures, automate repetitive tasks, and stay ahead of evolving threats.