Opinion
AI makes vulnerability detection table stakes, fixing is where vendors must compete
"As finding vulnerabilities gets easier," writes Legit Security CEO Roni Fuchs, "buyers will judge security products by how much of the work of fixing them they take off their teams’ hands."
Most application security tools still leave you at the same point: you connect them, they hand you a list, and your people still have to decide what matters, find the owners, and get a fix into production. For a long time, “we found things you would have missed” was enough. That era is ending.
AI is collapsing the value of detection alone. Advanced detection is available from more vendors. When several tools can produce a similar list, the product that wins is the one that helps finish the work after the list appears. This is clearest in application security, which protects the software businesses build and use.
The chief information security officers I talk with already face backlogs, tight budgets, and little prospect of adding staff. Better detection helps expose risk. It also makes the unfinished work impossible to ignore.
I came up as a developer, so I’m biased toward tools that make builders faster. AI accelerates code creation and helps attackers find weaknesses faster. The window to deal with real flaws is shrinking from both directions. Security’s job is to make faster development safe enough to sustain. Every ticket an engineer has to investigate adds a cost that the price of a scanner never fully captures.
Consider a vulnerable open-source component used across several applications. Different tools may flag it in different places, creating separate tasks for one shared problem. Before anyone changes anything, someone must know where it is deployed, whether an attacker can reach the vulnerable functionality, which team owns it, and whether a severe flaw in unused code deserves the same response as one in an exposed service handling customer data. Counting alerts tells you almost nothing about that engineering work. A ticket closed and a risk removed are not the same thing.
That is why organizational context is becoming part of the product. Source code alone does not show deployment, ownership, or business impact. At Legit, we have spent years mapping those relationships across the software factory. For AI agents that prepare and check fixes, that map helps turn a proposed patch into a change that can move through a real organization. Models that write code are widely available; each customer’s map of applications, teams, and environments has to be built.
The product’s job should extend from the finding through selecting the right fix, preparing the change, getting it to the right developer, and checking the result. Scanners remain essential sources of information within that process. Customers should expect the platform to carry work across gaps their teams have been bridging by hand.
Human responsibility stays central. Engineers and security leaders are accountable for what reaches production, including changes prepared by agents. They need evidence they can review: what changed, why it was prioritized, which checks ran, and what remains uncertain. Automating preparation is useful only if developers can confidently assess the changes; otherwise, it simply creates another queue.
Application security teams are becoming managers of security agents. They can translate more of their judgment into policies that define which classes of fixes agents may prepare, what evidence is required, and when a case must be escalated. This helps straightforward work advance consistently while humans focus on exceptions and higher-stakes decisions. The quality of those rules, and visibility into how they are applied, become part of what the customer is buying.
Buyers should test for this. In a trial, follow a real vulnerability through to a verified change in the affected environment. Watch how much investigation, coordination, and review your team still has to do. Ask where work stops when the system lacks information. A demo that ends with a generated patch leaves the hard questions unanswered: was the fix deployed, and did it reduce risk? For vendors, taking on that work means integrating more deeply with how customers build, test, and release software, and maintaining those connections as applications and teams change. As detection gets more widely available, the ability to keep a fix moving through a real organization is what customers will keep paying for.
Roni Fuchs is co-founder and CEO at Legit Security.
