CISA finds AI tools improve vulnerability detection

The AI security shift

The Cybersecurity and Infrastructure Security Agency (CISA) recently concluded a pilot program to evaluate how artificial intelligence performs in identifying software flaws. From late 2023 to early 2024, the agency tested whether products using AI, including large language models (LLMs), could detect critical vulnerabilities more effectively than those without it.

The results suggest that AI can handle the predictable and measurable aspects of cybersecurity. Because security flaws are often logical patterns, they can be taught to and evaluated by machines. This shift allows for a more automated approach to finding the bugs that currently plague modern technology.

CISA provided a report on these findings to the White House in July 2024. The agency is currently working on final guidance, which is expected to be released in January 2025, regarding how these tools should be integrated into security practices.

A history of weak code

The current state of cybersecurity is often described as a system built on bureaucracy rather than algorithmic security. Historically, if a system was hacked, the response was often legal and administrative rather than a fundamental fix for the underlying code. For example, the first major incident, the Morris worm, occurred a long time ago.

Despite decades of development, many programs are still written in languages like C, which are prone to memory safety issues. It is only recently that CISA began mandating the use of memory-safe programming languages in its guidance. This suggests that software security has not always been a primary priority for manufacturers.

Many modern devices are designed to be convenient rather than transparent. For instance, many smartphones have bootloaders that are locked to protect only the manufacturer's firmware. This prevents users from having full control over their own hardware while making it harder to verify the security of the software running on it.

Hidden flaws in hardware

Significant security risks remain hidden in 'binary blobs,' which are pieces of software that users cannot see or modify. These are common in smartphone radio interfaces and Wi-Fi firmware. Researchers have recently used automated tools to reverse-engineer these components, uncovering hundreds of undocumented commands and several zero-day vulnerabilities in just two weeks.

The source notes that some major chip manufacturers have produced hardware that is packed with vulnerabilities and unsolicited telemetry. In some cases, these bugs are so widespread that providers must create specific workarounds just to achieve basic cellular coverage. This highlights a gap where hardware security is often sacrificed for production speed.

Because these components are often closed-source, it is much harder to spot vulnerabilities compared to open-source code. This creates a situation where security is not a matter of whether a device can be hacked, but rather how many resources an attacker has to find the specific flaws in the hardware.

The democratization of risk

New AI models, such as Mythos AI, are being trained on datasets created by security experts. This means that the specialized knowledge required to find and exploit vulnerabilities is becoming more accessible to the general public. While this helps defenders, it also lowers the barrier for anyone looking to find weaknesses in common systems.

The government and security agencies are aware that these tools will eventually be available globally. If these capabilities reach every corner of the world, the current security model—which relies on the difficulty of finding bugs—could fall apart. Software and hardware security are currently too low to be fixed by a single patch alone.

The government may be hesitant to fix every security problem because doing so might change how people use technology. If systems were perfectly secure, users might demand more control, such as self-hosting data or compiling their own firmware. Instead, the current model favors the ease of use provided by major corporations like Microsoft or Apple.

The reality of updates

A major challenge in modern security is the sheer volume of older, vulnerable devices currently in use. This includes routers with unpatched firmware, industrial control systems, and smartphones that no longer receive updates from their manufacturers. These devices continue to acquire new vulnerabilities every day, even though their code never changes.

In the open-source world, the standard practice is now to constantly update dependencies. This is often done not because the new versions are inherently safer, but because new vulnerabilities are constantly being discovered in old code. Keeping software current is the primary way to stay ahead of these newly identified flaws.

As AI tools make it easier to find these bugs, the pressure to maintain and update systems will increase. Users are encouraged to keep their devices updated to mitigate the risks posed by these increasingly discoverable vulnerabilities. The security landscape is moving toward a model where constant vigilance and rapid patching are the only defenses.