Scanner Results Are a Starting Point. Here’s What Comes Next. | Application Security Weekly

From Scanner Results to Validated Risk

AI is accelerating vulnerability discovery, but finding more flaws is only useful if security teams can determine which ones create real risk.

In this Application Security Weekly discussion, XBOW Security Lab leader Federico Kirschbaum explains why scanner results should be treated as a starting point, not a final answer. Traditional tools identify patterns, while AI-powered penetration testing can reason through applications, adapt its approach, chain weaknesses, and produce evidence that a vulnerability is actually exploitable.

The conversation also highlights the importance of combining capable models with purpose-built harnesses that provide context, tools, safety controls, and clear testing objectives. This allows AI agents to work systematically while reducing hallucinations and unnecessary noise.

Human expertise remains critical. Experienced practitioners provide creativity, judgment, target selection, and secure-design guidance, while AI delivers broader coverage and faster execution. Together, they can shift application security from producing long lists of theoretical findings to delivering validated evidence teams can prioritize, reproduce, and fix.