AI Security Without Losing Control: Deterministic Tests at AI Speed
At it-sa 2026 in Nuremberg, AI security came up in many of the conversations at our stand. Visitors weren’t asking for another chatbot to answer their questions. They wanted to know what AI can do for them in practice: what they would have to do, how, and how much effort it takes, how AI can help steer their tools and fix what the scan finds, and whether all of it can run on-premises.
Many attacks now begin before a fix even exists. Google’s Mandiant puts the mean time to exploit in 2025 at an estimated minus seven days: “exploitation is routinely occurring before a patch is even released” (M-Trends 2026). For the sixth year in a row, exploits were the most common way in. In June, Germany’s Federal Office for Information Security (BSI) warned that AI “substantially lowers the effort, time and entry barriers for offensive cyber capabilities” (BSI, in German; our translation).
Our answer is a specific kind of AI security. We use AI once, at the source, to build deterministic vulnerability tests. Those tests run inside your network and give the same answer every time, and your vulnerability data doesn’t have to leave your infrastructure.
PHP2Shell: Attackers Didn’t Wait, and Neither Did We
On October 17, Amazon’s honeypots logged an exploitation attempt against two critical flaws in PHP (AWS). The flaws, CVE-2026-109618 and CVE-2026-109619, both have a CVSS 4.0 score of 9.2 and can allow remote code execution over HTTP without a login (our PHP2Shell post). PHP published fixes four days later, on October 21 at 14:00 UTC.
By the morning of October 21, hours before the fix, the OPENVAS ENTERPRISE FEED already had version checks for both flaws.
A day later, the feed had package-level checks for ten Linux distributions, and by October 26 for thirteen (our PHP2Shell post).
Attacks Got Cheap and Chained
Speed is only half of it. In November 2025, Anthropic described a cyber espionage campaign in which the attackers used AI “to execute 80-90% of tactical operations independently” (Anthropic). People stepped in at a few points, for example to approve the move from reconnaissance to active exploitation. Stringing many small steps together used to be the expensive part of an attack. As far as we can tell today, it isn’t anymore.
The same report has a detail that matters for defenders: the AI “frequently overstated findings and occasionally fabricated data”, including login credentials that turned out not to work. Keep that in mind for later.
Two Approaches to AI Security
Most cybersecurity AI on the market answers with more AI on the defender’s side. While this is technically impressive and enables real-time threat detection and automated responses while reducing human error, it is also usually achieved by utilizing models that run in large US clouds.
Before you sign up for that, ask three questions:
- Where does my vulnerability data go? It’s a map of every weak spot in your network.
- Who controls the model, and what changes with the next release?
- Who decides when a production system gets changed?
The other approach does one job very well and leaves the rest to you. That’s the one we take.
Where AI Belongs in Vulnerability Management: At the Source
Based on what we know today, AI scales best in one place: building our tests, once per vulnerability. Our security researchers use a combination of expert-guided AI, lab analysis and static automation to ensure high quality and rapid delivery. The finished test then runs on every system without any additional AI cost.
So why not let AI judge your systems directly? For one, the results vary. Thinking Machines Lab sent the same prompt to a language model 1,000 times at temperature 0, the setting meant to give the same answer every time, and got 80 different completions (Thinking Machines Lab). AI findings also need checking. The vulnerability intelligence vendor VulnCheck compared severity ratings for findings from Anthropic’s Glasswing project that have both an AI and a maintainer rating: the AI rated 91.5% of them critical or high, the maintainers only 51.3% (VulnCheck). Think back to the credentials that didn’t work.
Where Deterministic Tests Beat AI
A deterministic test gives the same result on the same system, which makes it evidence. The NIS2 implementing regulation, for example, asks certain digital infrastructure and ICT service providers to “perform, where appropriate, vulnerability scans, and record evidence of the results of the scans, at planned intervals” (Implementing Regulation (EU) 2024/2690, Annex 6.10.2(b)). An answer that changes from run to run is hard to file as evidence.
Our tests run authenticated on the host, where they see installed versions and configuration, and across the network, where reachability between systems shows possible attack paths. You can also look inside. The OPENVAS scanner is licensed under the GPL (GitHub) and the management daemon under the AGPL (GitHub). The vulnerability tests in our Community Feed are open source as well. That way, sovereignty isn’t something you have to take on trust.
AI Security Also Means Securing Your Own AI
AI security cuts both ways. Departments are putting AI agents and MCP servers into production, often faster than any central inventory can keep up with. Many of these are home-grown, which makes them hard for any scanner to fingerprint reliably. Where AI tools ship as established products, they get vulnerability tests like any other software.
Your Stack, Your Choice
Greenbone focuses on what we do best: finding vulnerabilities and telling you what to do about them. Fixing them is a different job, and automating it carries risks of its own. When AWS logged the exploitation attempt, no patch existed yet. In a situation like that, an automatic remediation tool has few options left, and one of them is shutting down services your business depends on. Good prioritisation also needs something no scanner knows on its own: which of your systems matter most.
So the decision stays with you. You can keep remediation fully manual, or connect the remediation tools you already trust. We don’t lock you into one.
MCP integration is on our roadmap. Through it, you will be able to connect the patch management and AI tools of your choice, and decide which model gets to see your data.
Open source has always worked this way: one tool does one job, and you combine the tools you trust. We see no reason AI security should work differently.
Same Speed. Your Control.
AI makes attacks cheap and chained. Defense needs AI at the same speed, inside your own infrastructure and under your own control. That’s the AI security we build.
Want to talk through what AI security looks like inside your own infrastructure? Get in touch with us.
