AI can find it, but can you fix it everywhere? The playbook for secure code at scale
Contents
We’ve talked to more and more teams holding vulnerability reports filled to the brim with static analysis findings, supply chain vulnerabilities, and tangled dependency graphs. With the release of the latest AI models like Anthropic’s Mythos, discovery has become cheaper than ever. The experience from a product team’s point of view hasn’t changed though.
Like any detector, these new AI tools act in the role of attacker and not fixer. They tell you what’s broken, but it’s up to you and your team to figure out the remediation. That could be tens, hundreds, or thousands of findings that must be closed in days, not weeks. Moderne recipes and structural code search tools like Moderne Trigrep enable teams to assess which repositories are impacted and then automatically fix vulnerabilities everywhere they occur across your organization.
Your code will never be as vulnerable as it is today.
One CVE, thousands of repositories
Every one of the CVEs listed on a team’s vulnerability report represents a question for your security organization: Is this the only repository that’s vulnerable or are there tens of thousands of others out there? This answer along with the likelihood of exploitability tells you which vulnerabilities are vital for teams to focus their limited attention on fixing immediately.
To make things more complicated, vulnerabilities in one repo for a team cut across many different layers of their application and tech stack, including the runtime environment that their application will land in, their container images, their open-source dependencies, and their code. We need tools that tackle vulnerabilities across all of these layers, as well as vulnerabilities that ping-pong between layers. Models like Mythos are able to figure out unique chains of seemingly-unrelated vulnerabilities to exploit in combination, an even greater threat.
In this case, the attacker and defender are held to different standards. The detector succeeds by finding one instance. A team is responsible for fixing that instance in that repository along with all of the other unrelated findings. An organization only reduces its risk surface area by closing every instance, everywhere. Otherwise, the business is still exposed.
You might be asking yourself: If an AI model can find these kinds of vulnerabilities, why not just ask the AI model to fix them too? This makes sense at the scale of one repository sitting in front of you today, but it can’t scale to your whole organization. It’s expensive to have your agent read your vulnerability report and your codebase and then remediate findings in that one repository alone (especially when you may have hundreds or thousands of other repositories with the same issue). Agents don’t work across hundreds of repositories, and their nondeterministic nature means the wider we throw them the more we have to review to make sure they actually did what we wanted them to do. We need other tools to turn that repeatable vulnerability remediation into org-wide change.
A security play for every layer of the stack across your whole portfolio
One thing is constant across all layers: the fix is a recipe. That’s a deterministic program that finds the pattern and fixes it, identically, from one repository to a hundred thousand. Recipes work because they run against the Lossless Semantic Tree (LST), a compiler-accurate representation of your code that captures type and dependency information. With recipes, you can understand and review the change in a single place, the recipe repository, and then roll it out confidently regardless of the size of your organization or the scope of impact for a particular vulnerability.
Moderne already provides security-focused recipes that cut across all of an application’s layers, finding patterns in your Dockerfiles, bumping your vulnerable transitive third-party dependencies, and identifying and transforming your code using industry-standard security best practices. These recipes can be run across many repositories at once using the Moderne Platform, giving you rapid access to which repositories are impacted by a vulnerability and providing the patches that will immediately fix those vulnerabilities.
Most teams aren’t asking “what recipe solves this specific vulnerability?” Instead, many are holding a stack of vulnerabilities across all of the layers of their application in a report and asking “how do I make this whole report go away?” We’ve collected the recipes used to tackle the various threats your teams are trying to remediate across these layers into a vulnerability remediation playbook for teams looking for a holistic framework of recipes to do just that.
| Layer | What it changes | Most impactful recipes |
|---|---|---|
| Infrastructure and base images | Terraform, Kubernetes resources, Dockerfiles | Find EOL base images, update base images, apply Docker and cloud provider security best practices |
| Third-party dependencies | This is where most of the exposure lives today: the complex web of open source libraries and frameworks that your application uses | Find and fix vulnerable dependencies (including transitive dependencies) |
| Code patterns | Static analysis findings in the code you own: SQL injection, weak cryptography algorithms, path traversal, cross site scripting, and others | Run OWASP Top Ten and other security-tagged code transformation recipes |
| Your organization and team standards | Areas of your code that aren’t in line with secure coding practices your organization is learning and capturing in a Confluence page today | Turn your written standards into an executable recipe |
| Major migrations | When you need to upgrade the complex frameworks your application is using and that means breaking code changes, recipes can help codify that work into repeatable, testable processes | Migrate to Java 25, Spring Boot 4.1, Python 3.14, NodeJS 24, and .NET 10 |
Coding agents eliminating vulnerabilities at scale
The final piece of the vulnerability remediation puzzle is when no recipe exists yet. Think of a Mythos-class discovery that sends your teams scrambling to fix a complex issue before an attacker figures out that same combination of exploits.
Here’s an example from one of our large financial customers:
An AI detector found a complex chain of vulnerable third-party dependencies and code paths that combined into a critical vulnerability. It surfaced in one repository, the security organization flagged it as a novel tier 1, and it became an all-hands-on-deck moment. An agent could have fixed that one repository, but the team’s real concern was blast radius across tens of thousands of others.
The team used Moderne to understand the impact across its lines of business and used Claude to build a recipe that could fix it at scale. They discovered that fewer than a hundred repositories were affected, and even fewer of those were public facing, which enabled the security team to downgrade the severity to tier 3. Instead of running an agent on every repository in isolation, they turned one agent session into a recipe that found and fixed the vulnerability across the impacted repositories.
With Moderne’s agent tools like Prethink for better deterministic context, Trigrep for structured code search across repositories, and MCP tools to interact with repositories through the lens of the LST and recipes, agents can turn their novel discoveries into procedural knowledge that scales across your organization.
Turning vulnerability remediation plays into a practice
Your code will never be in as rough a state as it is on your first recipe run. Follow the remediation pipeline from left to right on a regular basis to bring your code to a more secure state and keep it that way.
Start by tackling low hanging vulnerabilities with the Find and Fix Vulnerable Dependencies recipe and our secure coding recipes. Scan your code before and after and prove to yourself and your teams that these changes help remove the majority of your risk.
Security can’t stop at a single run. Instead, run this sequence of recipes regularly to tackle newly-found vulnerabilities as well as keeping new code in line with your security best practices. Turn new findings and any improvements done on top of the recipes into a feedback loop that enhances those recipes for your whole organization.
Finally, use your agents where they’re most valuable: detecting new vulnerabilities and turning those detections into repeatable processes that can scale across your portfolio. Turn an AI agent’s remediation plan into a single recipe artifact that you can review, test, and then roll out confidently across any repository without paying for the tokens or wondering if the agent actually solved the problem.
You (and your CISO) get three real outcomes in the end:
- A better security foundation when your recipes codify best practices and automatically bring new and existing code into line
- Broad, continuous eradication when whole chunks of your vulnerability report disappear with the run of a recipe
- Actual zero-day response when a disclosure turns into a recipe instead of a fire drill
Need security fixes for the end-of-life open source still running in production? Learn more about the Backpatch Alliance from Moderne.
Related posts
