Artificial intelligence is transforming how businesses develop software, but it is also changing the way cybercriminals identify and exploit security weaknesses. As AI-assisted development accelerates, traditional application-security processes are struggling to keep pace. At the same time, attackers can use AI to probe systems faster, operate at greater scale, and carry out sophisticated techniques with less technical expertise.
The numbers highlight the growing challenge. According to the National Institute of Standards and Technology, Common Vulnerabilities and Exposures (CVE) submissions to the National Vulnerability Database increased by 263% between 2020 and 2025. The FBI’s 2025 Internet Crime Report also recorded nearly $21 billion in reported internet-crime losses.
For enterprise leaders, this creates an operational and financial challenge. Security teams must identify exploitable vulnerabilities, determine which ones pose the greatest business risks, and address them quickly without significantly increasing manual review costs or disrupting critical systems.
In a recent series on the AI in Business Podcast, Niroshan Rajadurai, Chief Revenue Officer at XBOW, and Sridhar Boddula, Head of Security Platform Engineering at MassMutual, discussed how organizations can adapt their cybersecurity strategies to an environment where both software development and cyber threats are moving at machine speed.
Their insights highlight three important strategies: validating vulnerabilities through exploit testing, establishing governance for autonomous security tools, and prioritizing assessments of critical business systems.
Exploit Validation: Prioritizing Vulnerabilities by Business Risk
As AI-assisted software development increases the amount of code requiring security review, organizations must become more effective at distinguishing genuine vulnerabilities from false positives. However, identifying a weakness is only the first step. Security teams must also determine whether an attacker can actually reach and exploit it.
Niroshan Rajadurai explains that a vulnerability involves two important considerations: the underlying weakness in the code and whether that weakness can be accessed by someone attempting to cause harm.
Demonstrating exploitability helps security teams understand the potential consequences of a vulnerability. Depending on the weakness, an attacker may be able to extract sensitive information, execute commands on an affected system, or gain access to other parts of an organization’s network.
However, an unsuccessful exploit test does not automatically mean a vulnerability is harmless. Findings should still be evaluated alongside system exposure, asset sensitivity, and the possible consequences of compromise.
Sridhar Boddula reinforces the importance of assessing vulnerabilities according to the business criticality of the affected systems. For example, a weakness affecting an e-commerce company’s purchasing or sales infrastructure may deserve more immediate attention than a similar issue involving an internal system that is not accessible from the internet. The actual access paths and potential business impact must guide the decision.
Together, these perspectives suggest a more practical approach to vulnerability management. Organizations should determine whether an attacker can reach a weakness, establish whether testing demonstrates a viable exploit, evaluate what a successful attack could affect, and retest the system after remediation.
The final step is particularly important because a fix does not always eliminate the underlying vulnerability. Rajadurai describes a customer example in which a team attempted to block a malicious URL by adding a filter to its web application firewall. During retesting, the team changed one character to its percent-encoded equivalent, allowing the request to bypass the filter. The original fix had addressed only one version of the malicious input rather than the underlying weakness.
To evaluate whether autonomous vulnerability testing is improving security operations, leaders can monitor analyst hours spent validating findings, the time between vulnerability discovery and verified remediation, and the proportion of high-priority applications assessed during each testing cycle. These measurements help determine whether security coverage is expanding without requiring a proportional increase in staffing costs.
Built-In Governance: Keeping Autonomous Security Testing Under Control
AI can accelerate software development and security testing, but speed without proper safeguards can introduce additional risks.
Rajadurai points out that when AI models generate code much faster than human reviewers can evaluate it, manual approval processes can become a bottleneck. Requiring someone to approve every automated action may delay testing, especially outside normal working hours when reviewers are unavailable.
At the same time, allowing autonomous security tools to operate without boundaries can be dangerous. An automated testing model might identify a SQL injection vulnerability and attempt a destructive action, such as deleting a database table, without understanding the operational consequences.
This makes governance an essential part of autonomous security testing. Organizations need to establish authorized testing targets, prohibit destructive actions, define escalation conditions, and maintain audit requirements. These controls allow automated assessments to operate within approved boundaries while preserving organizational oversight.
Rajadurai also explains why building an internal AI security tool can be more difficult than expected. Based on his conversations with companies developing their own solutions, he estimates that approximately 80% of the work is relatively easy to build, while the remaining 20% presents the greatest challenges.
Those challenges include reducing false positives, establishing safety boundaries, supporting exploit generation within authorized testing frameworks, adapting to different AI models, and integrating validated findings into existing developer tools and coding assistants.
Sridhar Boddula adds that organizations must rethink how security teams work with software developers. Security should not remain a review queue that slows down development while attackers operate much faster. Instead, security engineers should work alongside development teams and become part of DevOps and DevSecOps pipelines.
Embedding security into development workflows allows organizations to identify risks earlier, apply policies through automated controls, and provide developers with prioritized findings and practical remediation guidance.
Boddula also emphasizes the importance of zero trust principles. Rather than automatically trusting users, devices, or applications, organizations should continuously verify access and restrict permissions according to actual business needs. Limiting unnecessary privileges can reduce an attacker’s ability to move between systems if an account becomes compromised.
By treating automation engineering as a core security discipline, businesses can reduce manual handoffs while maintaining oversight through established policies. This approach can expand testing capacity, improve response times, and help security teams focus their attention on issues that require human judgment.
Focused Testing of Critical Systems: Making Security Investment Count
AI has lowered some of the barriers to launching cyberattacks. Attackers can use AI-enabled probing, phishing tools, and synthetic media to carry out techniques that previously required more expertise and resources.
Boddula illustrates this shift with an example involving approximately $50 in access to an AI model, demonstrating how relatively inexpensive tools can make certain attack techniques more accessible. This figure represents the declining barrier to entry rather than the verified cost of carrying out a successful cyberattack.
Rajadurai highlights the imbalance between attackers and defenders. An attacker may need to discover only one exploitable vulnerability to compromise an application, while security teams must identify and address every weakness that could create a meaningful risk.
This imbalance strengthens the case for continuous, authorized security testing. Rather than relying exclusively on periodic penetration tests, organizations can assess important applications more frequently, validate potential attack paths, and determine whether remediation efforts have actually resolved the underlying issues.
Boddula also describes a hypothetical attack involving an AI-generated voice used to manipulate a help desk employee. The scenario continues with the compromise of a dormant service account and an attempt to gain additional access through the organization’s identity provider. Testing scenarios like this can help businesses determine whether existing security controls can prevent or interrupt an attack before it spreads.
For organizations looking to strengthen their security programs, the starting point should be identifying systems that contain sensitive information or support essential business operations.
A comprehensive asset inventory is an important first step. This includes identifying sensitive data, applicable regulations, data locations, processing activities, and accountable owners. Organizations should also consider internal applications, subscribed cloud services, managed platforms, and network hardware to improve visibility across their digital environments.
Once the inventory is established, applications can be prioritized according to business exposure. Public-facing systems connected to sensitive information, critical applications, or internal development environments may require more frequent assessments than isolated systems with limited access. Even seemingly simple applications should be evaluated for integrations, credentials, and possible access to other systems.
Security teams can then begin authorized testing of high-priority applications from an external perspective, including assessments that do not rely on existing credentials. This helps determine whether an attacker could gain access to important systems from outside the organization.
Identity and access weaknesses should also receive attention. Dormant service accounts, excessive permissions, unmanaged application programming interface keys, standing administrator access, and third-party integrations can create additional opportunities for attackers. Removing unnecessary access and strengthening identity controls can help reduce these potential entry points.
Finally, security leaders should communicate validated findings, remediation priorities, and assessment results to executive teams and boards. Evidence from an initial assessment can help demonstrate existing exposure, establish priorities, and support decisions about future security investments.
Boddula encourages organizations not to wait until the next audit or budget cycle before taking action. Instead, he recommends selecting at least one system that contains the organization’s most sensitive regulated data and conducting a focused security assessment.
His message is straightforward: taking action with an effective control today is more valuable than waiting for a perfect strategy that never gets implemented.
Moving Toward More Proactive Cybersecurity
As AI continues to accelerate software development and cyber threats, traditional security processes must evolve. Organizations need more than additional tools or larger review teams. They need security strategies that combine automated testing, clear governance, business-focused prioritization, and continuous verification.
Exploit validation can help distinguish vulnerabilities that pose immediate risks from findings that require further investigation. Built-in governance can keep autonomous testing within approved operational boundaries. Focused assessments of critical systems can provide the evidence leaders need to guide remediation and make informed investment decisions.
For enterprise security leaders, the immediate priority is to understand what an attacker could reach, validate the weaknesses that create the greatest business exposure, and establish a clear remediation plan. Starting with one high-value system can provide a practical baseline for expanding continuous testing and improving security coverage over time.