66% of billion-dollar companies leave critical bugs unpatched — the part the AI bug-hunting hype leaves out

What happened

Chainguard launched an AI-driven security tool called Harness, which identifies vulnerabilities missed by traditional scanners. The tool is part of a broader product suite, including enhanced CI/CD integration and secure package management. A survey revealed that 66% of large companies leave critical bugs unpatched, highlighting a gap between AI's ability to detect flaws and the slow pace of remediation.

Why it matters

The article underscores the growing challenge of securing software in an era where AI can rapidly identify vulnerabilities, but manual patching remains slow and resource-intensive. This highlights the need for integrated AI-driven security solutions to address critical infrastructure risks.

• AI can rapidly identify vulnerabilities, but manual patching lags behind.
• Hardware-isolated environments and secure CI/CD workflows are critical for modern security.
• AI-assisted tools are expanding to cover more programming languages and dependencies.

The bigger picture

The article suggests that AI tools like Harness could improve vulnerability detection, but the persistent gap between discovery and patching remains a critical challenge for enterprises. It also highlights the role of AI in enhancing software supply chain security.

Chainguard's AI-powered security tools aim to address critical vulnerabilities in software, but the survey results emphasize the ongoing challenge of timely patching in large organizations.

Technical details

• Hardware-isolated microVMs for coding agents with restricted network access.
• CI/CD checks executed within microVMs using warm snapshots and FIPS-compliant toolchains.
• Secure package endpoints for Go, .NET, JavaScript, and Go with CVE remediation.
• Signed attestations for CI/CD results and execution environments.
• Declarative egress policies to limit unauthorized network access.

FAQ