Cycode has introduced an AI agent to its application security posture management (ASPM) platform, designed specifically to assess how exploitable a vulnerability found in an application truly is.
In addition to this AI Exploitability Agent, Cycode has released an AI Security Return on Investment (ROI) Calculator that evaluates the impact of AI on various DevSecOps use cases.
Devin Maguire, senior product marketing manager at Cycode, explained that the AI Exploitability Agent simplifies prioritization for DevSecOps teams by focusing remediation efforts on vulnerabilities that pose the greatest risk to the organization.
This innovation comes at a critical time when AI coding tools are generating more vulnerabilities than ever. Cycode estimates that one security flaw emerges for every 10,000 lines of code written. Furthermore, approximately 40% of AI-generated applications contain some form of vulnerability.
More concerning is that cybercriminals are increasingly leveraging AI capabilities to discover and reverse engineer these vulnerabilities, escalating the threat landscape.
The Cycode AI Exploitability Agent is part of a broader suite of AI Security Teammates added earlier this year. These include:
- Change Impact Analysis Agent: Monitors code changes across pull requests to identify significant risk-altering modifications.
- Fix & Remediation Agent: Analyzes root causes of issues and suggests code fixes.
These AI agents integrate with Cycode’s proprietary Risk Intelligence Graph (RIG), which aggregates data from code repositories, workflows, secrets, dependencies, and cloud infrastructure assets. Support for the Model Context Protocol (MCP), an emerging integration standard originally developed by Anthropic, enables these agents to share data and correlate scans to consolidate alerts.
The ultimate goal is not only faster identification and remediation of vulnerabilities but also fostering better collaboration between application development and cybersecurity teams. Legacy application security tools often flag vulnerabilities in code that is inaccessible or never loaded into memory. In contrast, AI agents provide richer context by analyzing both code and runtime environments, enabling more accurate risk assessments.
A recent Futurum Group survey highlights that investments in ASPM platforms, DevSecOps automation, and orchestration are top priorities for organizations. Interestingly, responsibility for application security budgets is increasingly shared, with only 21% of respondents indicating security budgets as the sole source. Half of the respondents reported that application development teams now share ownership of application security.
As global regulations tighten, securing software supply chains will become increasingly vital. The pressing question is not if applications will become more secure, but how quickly and at what cost.
Originally published at DevOps.com on August 5, 2025.
Frequently Asked Questions (FAQ)
Vulnerability Assessment
Q: What is the primary purpose of Cycode's AI Exploitability Agent?
A: The primary purpose of the AI Exploitability Agent is to assess how truly exploitable a vulnerability found in an application is, thereby helping DevSecOps teams prioritize remediation efforts.
Q: How does the AI Exploitability Agent help DevSecOps teams?
A: It simplifies prioritization by enabling teams to focus on vulnerabilities that present the greatest risk to the organization.
Q: What is the estimated rate of security flaws in AI-generated code?
A: Cycode estimates that one security flaw emerges for every 10,000 lines of code written in AI-generated applications.
Q: What percentage of AI-generated applications contain vulnerabilities?
A: Approximately 40% of AI-generated applications are estimated to contain some form of vulnerability.
Q: How are cybercriminals leveraging AI in relation to application vulnerabilities?
A: Cybercriminals are increasingly using AI capabilities to discover and reverse engineer application vulnerabilities, thereby escalating the threat landscape.
Cycode's AI Security Teammates
Q: What are the other AI Security Teammates offered by Cycode?
A: Besides the AI Exploitability Agent, Cycode offers the Change Impact Analysis Agent (monitors code changes for risk-altering modifications) and the Fix & Remediation Agent (analyzes root causes and suggests code fixes).
Q: How do these AI agents integrate with Cycode's platform?
A: They integrate with Cycode's proprietary Risk Intelligence Graph (RIG), which aggregates data from various sources like code repositories, workflows, secrets, dependencies, and cloud infrastructure assets.
Q: What is the significance of the Model Context Protocol (MCP) in relation to these agents?
A: Support for MCP enables these AI agents to share data and correlate scans, which helps in consolidating alerts.
Application Security and Context
Q: What is a key limitation of legacy application security tools that AI agents address?
A: Legacy tools often flag vulnerabilities in code that is inaccessible or never loaded into memory. AI agents overcome this by providing richer context through analysis of both code and runtime environments for more accurate risk assessments.
Q: What is the trend in responsibility for application security budgets?
A: A recent survey indicates that responsibility for application security budgets is increasingly shared, with application development teams now sharing ownership with security teams.
Crypto Market AI's Take
The advancements in AI by companies like Cycode highlight a crucial trend: the increasing integration of artificial intelligence into critical cybersecurity functions. This mirrors the broader impact of AI across various industries, including the financial sector, where AI is revolutionizing market analysis, trading strategies, and risk management. For instance, our platform leverages AI-driven insights to help users navigate the complexities of the crypto market, offering tools for more informed decision-making. As AI agents become more sophisticated, their application in identifying and mitigating risks, whether in software development or financial markets, will continue to grow. This progress underscores the need for robust security measures in AI development and deployment, a domain where understanding and addressing vulnerabilities, much like Cycode's approach, is paramount. Explore our AI-driven solutions for cryptocurrency trading and market intelligence to see how AI is shaping the future of finance.
More to Read:
- AI-Driven Crypto Trading Bots: Maximizing Returns in Volatile Markets
- Understanding Vulnerabilities in AI-Generated Code
- The Future of Cybersecurity: AI's Role in Threat Detection
