Software delivery company Harness announced on August 19 a suite of AI-powered security tools designed to address vulnerabilities across enterprise software pipelines, targeting a problem the company says has become urgent: attackers now move from discovering a flaw to exploiting it in as few as six hours, while the average organization takes more than 50 days to implement a fix. The launch includes six capabilities—AI SAST, LLM scan orchestration, a Triage Agent, a Remediation Agent, a Zero-Day Agent, and virtual patching—all built to operate inside the software delivery pipeline rather than as standalone security products. Harness says the tools aim to shrink the window between detection and repair, potentially helping managed service providers and managed security service providers work through customer vulnerability backlogs with fewer manual steps.
The company's AI SAST tool combines rule-based analysis with an AI confidence layer, and in internal testing on OWASP Java, Harness says it cut false positives by 79%, dropping them from 454 to 95, while boosting precision from 74% to 93% and maintaining 91% recall. However, the challenge isn't just accuracy—it's volume. Harness cites Project Glasswing testing in which partners uncovered roughly 10 times more vulnerabilities using LLM-based scanning compared to traditional methods. Comcast reported that 44% of the critical- and high-severity findings flagged during its testing turned out to be false positives. The company notes that its results are based on its own benchmarking and haven't been independently verified.
"We're at a point where the same AI models helping our customers ship software faster are also what attackers are using to find and exploit vulnerabilities faster," said Rahul Sood, general manager of application security at Harness, in the company's announcement. According to Harness, its Triage Agent uses CVSS, EPSS, and reachability analysis to rank vulnerabilities by actual risk, while the Remediation Agent writes and validates a proposed fix before submitting a pull request for developer review and approval. The Zero-Day Agent continuously monitors for newly disclosed threats, identifies affected artifacts and pipelines, and prepares a validated fix for review. Virtual patching offers an additional safeguard while a permanent code fix is being completed—when testing identifies a vulnerability, the system can deploy a protective patch without requiring a code change, shielding production while developers work on the underlying repair.
The push reflects a broader shift in the threat landscape: AI-based scanners can uncover substantially more potential problems, but that leaves security teams with a much larger queue to investigate. Harness says the tools are designed to work within the software delivery pipeline rather than operate as disconnected security products, allowing organizations to move vulnerabilities from detection through remediation and deployment with fewer manual handoffs. The company is addressing not simply finding vulnerabilities but managing the flood of alerts they generate. Faster remediation doesn't eliminate the risks of automated code changes—a bad fix can introduce a new vulnerability or disrupt production—so Harness keeps developers in control by requiring human review before remediation pull requests are merged, and uses existing policy gates, approvals, and chain-of-custody controls to put limits around the agents.
The approach could help enterprises reduce repetitive security work and close the gap between the speed of attackers and the speed of defense, especially as adversaries increasingly use AI to find and weaponize flaws. Harness's hybrid model—combining deterministic analysis with AI confidence layers and allowing teams to run large language model scanners inside their pipelines—aims to balance the benefits of AI-driven discovery with the precision needed to avoid overwhelming security teams. By automating triage, remediation, and virtual patching while maintaining human oversight, the company is betting that organizations can compress vulnerability lifecycles from weeks to hours without sacrificing control. The balance between automation and governance will be critical as enterprises weigh the efficiency gains of agentic tools against the operational risks of delegating security decisions to machines, particularly in environments where a single misstep can cascade across production systems.