Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited.

The SonarQube Hunter Agent first analyzes an entire codebase to find three categories of flaws: broken access control, business-logic vulnerabilities, and authentication or session-management issues.

Satinder Khasriya, a technical product marketing manager for Sonar, said that, historically, discovering these issues would have required manual testing or a penetration test. The AI agent developed by Sonar automates those investigations by tracing how code and data move through a system in a way that can now run on demand, he added.

Additionally, SonarQube Hunter Agent is able to identify the developer who created any piece of code, with verified issues that are surfaced within a DevSecOps workflow via integrations with continuous integration/continuous delivery (CI/CD) platforms.

That’s critical because as advances in AI now make it possible for cybercriminals to discover and exploit vulnerabilities in a matter of hours, DevSecOps teams need to be able to identify issues at machine speed versus waiting until they might be discovered using legacy scanning tools, noted Khasriya. The time to exploitation after a vulnerability has dramatically shrunk, he added.

Deterministic scanning tools are good for catching flaws that look wrong in the code, such as injection vulnerabilities, unsafe data flows, and insecure patterns, but some vulnerabilities aren’t detectable in code, he added. A privilege escalation issue, for example, only becomes visible when there is an understanding of how the code is supposed to function, said Khasriya.

As the threat landscape continues to evolve, it is becoming more critical than ever to discover and verify issues as early as possible in the software development lifecycle, noted Khasriya. Every line of code is now part of the attack surface that DevSecOps teams need to defend, he added. The challenge is that the rate at which that code is being created is overwhelming existing DevSecOps workflows, he added.

It’s already apparent each software engineering team will now need to revisit those workflows sooner than later. Historically, many application development teams might have allocated a few hours a month to creating a patch that might not be deployed for months. In some cases, the exploit of a vulnerability is now being developed faster than the patch needed to remediate it. DevSecOps teams are simultaneously trying to eliminate vulnerabilities in new code while also having to pay down massive amounts of technical debt that has been allowed to accrue for decades. Software engineering teams will need to be able to continuously deploy patches in near real time as quickly as possible, assuming, of course, the patch itself has been verified to be free of malware.

Hopefully, there won’t require multiple application security incidents before organizations allocate the resources needed to safely deploy applications in the AI era. In the meantime, however, DevSecOps teams might be well-advised to, while continuing to hope for the best, prepare now for the worst.