From Vulnerability Fatigue To Autonomous Remediation

Software security has always felt like painting the Golden Gate Bridge—you finish one end, and by the time you’re done, the other end is already peeling. Security teams constantly chase down vulnerabilities, only to watch the backlog grow faster than fixes can roll out. Even the most advanced DevSecOps programs end up buried under alerts, prioritization exercises, and manual remediation efforts that can’t keep up with modern release velocity.

In a recent 909Cyber LinkedIn Live session, Den Jones, founder of 909Cyber, moderated a conversation with Javed Hasan of Lineaje and Kumar Chivukula of Opsera. Their discussion focused less on the marketing spin and more on what the industry gets wrong—and what might finally help teams get ahead of the problem.

Like many ideas in Silicon Valley, this one started over coffee. Hasan and Chivukula share how they quickly recognized that their work addressed different halves of the same problem. One focused on finding and mapping vulnerabilities across the software supply chain, the other on automating workflows to fix them. Put together, they sketched out a model for what Hasan called “application-aware self-healing”—scanning, planning, and then autonomously rebuilding secure containers before they ever hit production.

For years, the industry has celebrated tools that surface more vulnerabilities, faster. The problem is that most teams already know they have vulnerabilities—they just can’t fix them quickly enough. Chivukula put it plainly during the session: “Nobody wants to be fatigued with a bunch of alerts, a bunch of vulnerabilities anymore. It’s not about showing the vulnerabilities, it’s about showing and fixing them.”

This hits on something I’ve seen over and over in conversations with CISOs: alert fatigue is not just a nuisance, it’s a structural failure. More data without more action widens the gap between security and development, and that gap is where attackers thrive.

The conversation eventually turned to AI. Hasan described how their teams use lightweight AI agents to handle tasks like compatibility checks, container rebuilding, and generating pull requests. He emphasized, “The value of AI is in the delivery of the value, not in hyping the list of agents that we might have built.”

Yet AI also magnifies risks. As Chivukula noted, code assistants are helping less-experienced developers ship software that inherits open-source dependencies they don’t fully understand. That makes automation in remediation not just a time-saver but a necessity.

Another thread worth pulling on was human error. Prioritization and patching are still manual, skill-dependent processes. Hasan pointed out that some customers are pushing a million updates a day. At that scale, by the time vulnerabilities are prioritized, the code has already changed. That’s the reality: traditional workflows can’t keep up with modern software velocity.

This is where automation reframes the equation. Instead of accepting that some vulnerabilities will ship, organizations can fix nearly all of them by default. It’s a shift from reactive to proactive security—and one that challenges the assumption that vulnerability management must always be an exercise in triage.

The numbers are compelling, but they also require a dose of caution. Hasan cited reductions of more than 90% in critical and high vulnerabilities in some environments, along with thousands of hours saved. Those claims mirror what many vendors like to promise, but in this case, the difference is that remediation is built into the pipeline rather than bolted on after the fact. That design choice matters.

In my own experience, the organizations that succeed in security are the ones that build fixes into the flow of work. The technology is important, but the cultural shift—moving security from an obstacle to an enabler—is where the lasting value comes from.

For years, vulnerability management has meant endless patching and prioritization, with little confidence the work would ever be “done.” The partnership discussed here points to a different model—one where autonomous remediation makes secure delivery the baseline rather than the aspiration. As Hasan closed, “Building safe, transparent applications and deploying them is possible.” Whether this exact approach becomes the industry standard or simply pushes others to evolve, the bigger takeaway is that security no longer has to be defined by fatigue. For CISOs and developers alike, that shift could be the real game-changer.