Vulnerability Management
Automated Zero-Day Discovery: How AI Is Changing Vulnerability Research
AI-powered fuzzing and code analysis are accelerating zero-day discovery. Here's what that means for defenders.
Feb 3, 20266 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
AI-powered fuzzing and code analysis are accelerating zero-day discovery. Here's what that means for defenders.
Getting the CWE right is not a taxonomic hobby. It drives remediation, compliance mapping, and detection engineering. Here is how grounded and pure-LLM scanners compare.
Most AI bug hunters skip the hardest step: trying to kill their own findings. Here is why Griffin AI's disproof pass is the single biggest lever on false-positive rate.
Two AI bug hunters can both generate hypotheses. Only one can defend them. A field study of grounded versus ungrounded hypothesis generation in zero-day discovery.
A candid look at how Griffin AI's three-stage zero-day pipeline compares to pure-LLM Mythos-class bug hunters, and why false positive rates matter more than raw volume.
A critical file upload vulnerability in SAP NetWeaver Visual Composer was exploited to deploy web shells on enterprise SAP systems. The flaw required no authentication and scored 10.0 on CVSS.
A stack-based buffer overflow in Ivanti Connect Secure was exploited by Chinese threat actors just months after the previous zero-day in the same product. The vulnerability was initially misclassified as low-risk.
Kaspersky discovered a Chrome zero-day being exploited in a targeted espionage campaign dubbed Operation ForumTroll. The flaw broke Chrome's sandbox with no user interaction beyond clicking a link.
SonicWall disclosed CVE-2025-23006, a critical deserialization vulnerability in its SMA 1000 series gateways that was actively exploited as a zero-day before patches were available.
Weekly insights on software supply chain security, delivered to your inbox.