Ivanti Uses LLMs to Find and Fix Critical Vulnerabilities

Ivanti Uses LLMs to Find and Fix Critical Vulnerabilities

Ivanti has successfully deployed large language models to discover and remediate security vulnerabilities in its products, including a maximum-severity flaw that traditional security tools missed entirely.

The software vendor disclosed CVE-2026-10520, a critical vulnerability with a perfect 10.0 CVSS score in its Sentry mobile gateway product last month. An LLM discovered the flaw — not security researchers, third-party vendors, or Ivanti's own engineering team.

Why it matters

This represents a practical application of AI in defensive security that goes beyond theoretical promise. While much attention focuses on AI-enabled attacks, Ivanti's experience demonstrates that frontier models can identify vulnerability classes that evade static and dynamic analysis tools, potentially shifting the economics of software security. However, the company's chief security officer notes this hasn't yet leveled the playing field with attackers, who face no operational constraints around code quality or deployment cycles.

Two-track approach to AI security

Ivanti launched its LLM security project in early March, according to Daniel Spicer, the company's chief security officer. The initiative runs on two parallel tracks: automatically resolving vulnerabilities identified by existing scanners, and finding new vulnerabilities that traditional tooling misses.

The remediation track addresses a common security workflow bottleneck. When static application security testing (SAST) and dynamic application security testing (DAST) scanners identify code weaknesses, engineers must manually determine whether each weakness represents an actual exploitable vulnerability and then fix it. Ivanti's approach intercepts these findings, uses LLMs to generate fixes, and resubmits corrected code to engineers.

"I have a feeling that eventually there probably won't even be an engineer at the loop on that, if I'm being honest," Spicer told Dark Reading, which first reported details of the project.

The company uses multiple frontier models, including Anthropic's Claude and OpenAI's GPT variants, plus select open-source models run internally. Rather than scoring models against each other broadly, Ivanti creates specialized prompts for specific vulnerability classes organized by Common Weakness Enumeration (CWE) categories.

Managing costs and expectations

Ivanti started with low-complexity CWEs and gradually increased difficulty, which helped the team identify where AI would struggle and costs would escalate. Spicer said he's issued internal guidelines on appropriate AI use after team members attempted tasks poorly suited to LLM capabilities.

The models have proven particularly effective at identifying missing authorization or authentication on endpoints — a gap where traditional SAST scanners struggle because they follow data flow through functions without recognizing that certain endpoints require access controls.

One unexpected finding: The quality of AI-generated bug bounty submissions has improved dramatically since early 2025, while the volume of low-quality reports has dropped significantly. Spicer noted that a monthly Claude subscription could potentially generate bug bounties worth thousands of dollars, fundamentally changing the economics of vulnerability research.

Continuous evolution required

Spicer emphasized that teams must retest prompts and skills with each model update, even minor version changes. The technology hasn't eliminated the traditional enterprise patch management challenge, he noted, and attackers retain advantages in speed and flexibility since they don't need to worry about code quality or operational constraints.

Ivanti plans to release additional research on its findings in coming months. Details of the project were first reported by Dark Reading in an interview with Spicer this week.