Laurent Giraid brings a seasoned technologist’s eye to the rapidly shifting world of AI and cybersecurity. As an expert in machine learning and natural language processing, he has watched the transition from static security tools to dynamic AI models that can reason through code like a human researcher. Our conversation covers the evolution of zero-day exploits, the technical debt hidden within container layers, and why the future of defense relies as much on clean inventories as it does on smart algorithms. We discuss the rise in enterprise-targeted attacks and how tools like Google’s CodeMender are beginning to automate the grueling task of patching open-source software.
How is AI fundamentally changing the types of vulnerabilities that security researchers—and threat actors—are able to uncover compared to traditional methods?
Traditional tools like fuzzers and static analysis are incredibly reliable at catching implementation “crashes” or memory errors, but they often hit a wall when it comes to deep logic. AI models are changing the game because they can interpret the intent behind a codebase, allowing them to spot logical contradictions that leave no obvious technical footprint. A landmark moment occurred in May 2026, when researchers identified a Python script used to bypass two-factor authentication on a system administration tool. It wasn’t a standard exploit; it was a hard-coded trust assumption that an AI likely helped discover and weaponize. You could see the “fingerprints” of the AI in the script’s unusually structured coding style and its fabricated vulnerability score, marking a shift toward more sophisticated, automated discovery.
With 90 zero-days tracked in 2025 compared to 78 in 2024, what does this rising volume tell us about the current state of enterprise security?
These numbers represent a record-breaking pace that is putting immense pressure on security teams everywhere. What is particularly striking is that enterprise software and appliances accounted for 43 of those cases in 2025, which is roughly 48% of the total. This tells us that the “perimeter” is no longer just a firewall; it is a sprawling collection of complex software that is being targeted more aggressively than ever. When nearly half of the world’s zero-days are hitting enterprise-grade tools, the margin for error in response time becomes razor-thin. We are seeing a high-stakes race where the sheer volume of exploits is threatening to outpace the traditional human-led remediation cycle.
Why has the complexity of modern container environments become such a massive hurdle for teams trying to respond to incidents like Log4Shell?
The reality of modern infrastructure is that a single container image is often a “black box” filled with layers of inherited dependencies and operating system packages. When a flaw like Log4Shell broke the internet in 2021, the panic wasn’t just about the code itself, but the fact that the vulnerable library was buried deep within thousands of different products. Organizations realized they had been adding packages they didn’t even need, creating a massive, invisible surface area for attack. It feels like trying to find a specific contaminated ingredient in a pantry full of unlabeled jars. Without a clear software bill of materials, you are essentially flying blind, spending days or weeks just trying to locate where the “poison” is running before you can even think about applying a fix.
When looking at AI-driven solutions like CodeMender, which contributed 72 security fixes in its first six months, what remains the biggest challenge in automating the patching process?
The success of CodeMender is impressive, but it highlights a critical “human-in-the-loop” reality that we cannot ignore. While the system can combine model reasoning with runtime testing to propose a fix, those 72 patches weren’t just blindly injected into the code; they required rigorous human review. Experts have to ensure that the AI is addressing the root cause rather than just masking a symptom, all while checking for regressions that could break the entire system. Even after a patch is approved, the work isn’t done until you identify every single affected image across your environment and rebuild it. AI can write the cure, but it can’t always find every patient in a poorly documented hospital, which is why package records and software context remain the missing links.
If AI is speeding up the discovery and weaponization of flaws, why do you argue that finding the vulnerability may no longer be the slowest part of the security lifecycle?
We are entering an era where the bottleneck has shifted from “finding the needle” to “knowing where the haystack is.” While an attacker might use an AI to find a flaw in minutes, a defender might still spend agonizing hours opening up container images and checking package lists by hand just to see if they are at risk. The true practical advantage in today’s landscape belongs to organizations that have done the “boring” work of maintaining accurate inventories and minimal images. If one team can search a database and see their exposure immediately while another is still manually auditing their workloads, the gap in response time becomes a chasm. Discovery is getting faster for everyone, but the ability to deploy a tested repair is what actually stops a breach, and that depends entirely on operational visibility.
What is your forecast for AI-driven cybersecurity?
I expect we will see a shift where the “arms race” moves away from just finding bugs and toward the autonomous management of entire software lifecycles. We are heading toward a future where AI doesn’t just suggest a patch, but automatically generates a Software Bill of Materials (SBOM), identifies every instance of a vulnerability across a global cloud footprint, and initiates a rebuild of those containers in a matter of seconds. However, this will also lead to more “hidden” exploits where AI-generated code is used to create logical traps that are nearly invisible to the human eye. The ultimate winners will be the organizations that treat their software inventory as a living, breathing data set rather than a static document, allowing them to move at the same speed as the automated threats they are facing.
