Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation Push
Ivanti is integrating LLMs to automate vulnerability remediation, signaling a shift toward AI-driven cybersecurity defenses and autonomous patching.
This article is original editorial commentary written with AI assistance, based on publicly available reporting by Dark Reading. It is reviewed for accuracy and clarity before publication. See the original source linked below.
The cybersecurity landscape is currently defined by a widening "asymmetry of speed." While threat actors use automation to exploit vulnerabilities within hours of discovery, corporate security teams often remain bogged down in manual patching cycles that can stretch for weeks. Recognizing this disparity, Ivanti has signaled a significant pivot toward integrating Large Language Models (LLMs) into the heart of its remediation workflows. According to Ivanti CSO Daniel Spicer, the company is experimenting with frontier models to automate the identification and fixing of security flaws, marking a transition from traditional rules-based automation to more flexible, generative intelligence.
This push into AI-driven remediation follows a particularly scrutinized period for Ivanti. Over the past year, the company faced a series of high-profile zero-day vulnerabilities in its VPN and gateway products, which were exploited by state-sponsored actors and led to widespread emergency directives from the Cybersecurity and Infrastructure Security Agency (CISA). These challenges have clearly catalyzed an internal mandate to redefine "defense at scale." By leveraging LLMs, Ivanti aims to move past simple signature matching, instead using AI to interpret complex codebases and generate remediation scripts that can adapt to the unique environments of diverse enterprise customers.
The mechanics of Ivanti’s initiative involve a sophisticated layering of AI capabilities. Rather than relying on a single model, the strategy involves utilizing "frontier models"—those at the absolute cutting edge of reasoning and coding capabilities—to parse vulnerability reports and cross-reference them with internal patch libraries. The primary goal is to automate the translation of a Common Vulnerabilities and Exposures (CVE) notification into an actionable, tested remediation plan. This involves using the LLM to predict potential side effects of a patch, effectively acting as an automated Quality Assurance (QA) engineer that can flag if a fix might break legacy software dependencies.
However, the transition to autonomous patching is fraught with economic and operational hurdles. Spicer has pointedly raised the issue of cost-per-query, noting that while frontier models are highly effective, the computational expense of running massive AI models against every minor software flaw is currently prohibitive for many organizations. Furthermore, the "human-in-the-loop" necessity remains a critical bottleneck. While an LLM can generate a fix in seconds, trust in AI-generated code is not yet absolute. Security practitioners must still validate these fixes to prevent "hallucinations" or logical errors from introducing new vulnerabilities, a process that risks replicating the very human delays the technology is meant to solve.
The implications for the broader cybersecurity industry are profound. If successful, Ivanti’s approach could force a shift from "Vulnerability Management" to "Vulnerability Resolution." Historically, security vendors have focused on discovery—telling companies what is broken. The market is now shifting toward fixing—actually repairing the holes. This shift will likely spark a competitive arms race among IT management software providers to integrate the most reliable AI-orchestration layers. It also raises significant regulatory questions: if an AI-generated patch causes a massive system failure or an accidental data breach, the legal framework for liability between the software vendor, the AI provider, and the end-user remains dangerously undefined.
Looking forward, the success of this automation push will depend on the evolution of "small language models" (SLMs) and specialized fine-tuning. For the industry to scale these solutions, the intelligence must become cheaper and more localized. We should watch for Ivanti and its competitors to begin moving away from generalized frontier models toward domain-specific AI trained exclusively on secure coding practices and historical patch data. As these models become more reliable, the "human-in-the-loop" will likely transition to a "human-on-the-loop" role, where security professionals oversee high-level policy while the AI handles the granular, daily battle of closing security gaps in real-time.
Why it matters
- 01Ivanti is leveraging frontier LLMs to bridge the speed gap between rapid exploit discovery and the traditionally slow pace of manual patch deployment.
- 02The primary obstacles to widespread AI remediation remain the high computational costs of frontier models and the persistent need for human verification to prevent AI-generated errors.
- 03This shift signals an industry-wide move toward 'autonomous defense,' where AI transitions from a diagnostic tool to an active participant in code repair and system hardening.