--- title: Remediating Vulns With LLMs: Inside Ivanti's Automation Push description: Ivanti CSO Daniel Spicer details the company's internal project using LLMs (primarily Claude and GPT models) to both find and automatically remediate software... canonical: https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Remediating Vulns With LLMs: Inside Ivanti's Automation Push | daily.dev og:description: Ivanti CSO Daniel Spicer details the company's internal project using LLMs (primarily Claude and GPT models) to both find and automatically remediate software... og:url: https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq og:image: https://api.daily.dev/og/posts/QHmV8eedQ.png og:image:alt: Remediating Vulns With LLMs: Inside Ivanti's Automation Push og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Remediating Vulns With LLMs: Inside Ivanti's Automation Push **[Dark Reading](https://daily.dev/sources/dr)** · 14 min read · 2 upvotes · 0 comments ## Summary Ivanti CSO Daniel Spicer details the company's internal project using LLMs (primarily Claude and GPT models) to both find and automatically remediate software vulnerabilities. Started in March, the project runs two tracks: auto-fixing weaknesses flagged by SAST/DAST scanners before engineers see them, and finding vulnerabilities that traditional tooling misses. Early results are promising — LLMs show particular strength in detecting missing authorization/authentication on endpoints. Spicer discusses the agent harness design (scoped, short-lived, no broad system access), cost management challenges, the need to retest prompts with every model update, and the observation that AI-generated bug bounty reports have shifted from low-quality slop to more credible submissions. He remains cautious about whether this truly levels the playing field with attackers, citing operationalization overhead and the persistent enterprise patch management burden. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How is Ivanti using LLMs to automatically fix vulnerabilities found by SAST and DAST scanners? Ivanti feeds a scanner-identified weakness to an LLM agent as a scoped pull request, has the agent generate a fix within that self-contained harness (no broad GitHub or OS access), then resubmits the fix through the SAST/DAST scanner to confirm resolution before automated performance and bug testing and handoff to an engineer. The project started with low-complexity CWEs before moving to more complex ones. _Anyone building an AI-driven remediation pipeline can track real-world approaches like this one on daily.dev._ ### What kinds of vulnerabilities are LLMs better at finding than traditional SAST scanners? LLMs excel at catching missing or insufficient authorization and authentication on endpoints, a gap traditional SAST tools have because they trace data flow through a function without recognizing that the endpoint itself needs an auth check. Given a mapping of endpoints, an LLM can flag where authorization appears missing, a task historically requiring human review. _Security engineers weighing AI versus static analysis for auth gaps can follow this kind of finding on daily.dev._ ### Has AI changed the quality of bug bounty submissions Ivanti receives? Yes, bug bounty report quality improved sharply starting around January to February, after a period of heavy AI-generated 'slop' the prior year that made it hard to meet posted SLAs. Reports now arrive 75-80% polished or fully well-written, submission volume has dropped significantly, and one report was traced to formatting patterns resembling an Opus model output tied to a $5,000-$10,000 payout. _Teams managing bug bounty programs can watch how AI is reshaping submission quality and volume on daily.dev._ ## Similar posts on daily.dev - [A Blueprint for AI-Assisted Vulnerability Management](https://daily.dev/posts/a-blueprint-for-ai-assisted-vulnerability-management-j5th1fhxw) · Google Cloud · 1 upvotes · 0 comments - [Using LLMs to Find Security Bugs: A Practitioner’s Playbook](https://daily.dev/posts/using-llms-to-find-security-bugs-a-practitioner-s-playbook-llrqsqe4g) · Tech Lead Digest · 0 upvotes · 0 comments - [Finding Bugs using LLMs](https://daily.dev/posts/finding-bugs-using-llms-pbp8oopzr) · Materialize · 0 upvotes · 0 comments - [Using LLMs to Find and Prioritize Vulnerabilities Is No Easy Task](https://daily.dev/posts/using-llms-to-find-and-prioritize-vulnerabilities-is-no-easy-task-dtmgdglfx) · Dark Reading · 5 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Remediating Vulns With LLMs: Inside Ivanti's Automation Push","url":"https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq"},"datePublished":"2026-07-20T20:56:29.721Z","dateModified":"2026-09-13T20:54:34.313Z","description":"Ivanti CSO Daniel Spicer details the company's internal project using LLMs (primarily Claude and GPT models) to both find and automatically remediate software...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/01328ae688d8e416a688c78012b6f7d8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/01328ae688d8e416a688c78012b6f7d8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Remediating Vulns With LLMs: Inside Ivanti's Automation Push"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/remediating-vulns-with-llms-inside-ivanti-s-automation-push-qhmv8eedq#faq","mainEntity":[{"@type":"Question","name":"How is Ivanti using LLMs to automatically fix vulnerabilities found by SAST and DAST scanners?","acceptedAnswer":{"@type":"Answer","text":"Ivanti feeds a scanner-identified weakness to an LLM agent as a scoped pull request, has the agent generate a fix within that self-contained harness (no broad GitHub or OS access), then resubmits the fix through the SAST/DAST scanner to confirm resolution before automated performance and bug testing and handoff to an engineer. The project started with low-complexity CWEs before moving to more complex ones. Anyone building an AI-driven remediation pipeline can track real-world approaches like this one on daily.dev."}},{"@type":"Question","name":"What kinds of vulnerabilities are LLMs better at finding than traditional SAST scanners?","acceptedAnswer":{"@type":"Answer","text":"LLMs excel at catching missing or insufficient authorization and authentication on endpoints, a gap traditional SAST tools have because they trace data flow through a function without recognizing that the endpoint itself needs an auth check. Given a mapping of endpoints, an LLM can flag where authorization appears missing, a task historically requiring human review. Security engineers weighing AI versus static analysis for auth gaps can follow this kind of finding on daily.dev."}},{"@type":"Question","name":"Has AI changed the quality of bug bounty submissions Ivanti receives?","acceptedAnswer":{"@type":"Answer","text":"Yes, bug bounty report quality improved sharply starting around January to February, after a period of heavy AI-generated 'slop' the prior year that made it hard to meet posted SLAs. Reports now arrive 75-80% polished or fully well-written, submission volume has dropped significantly, and one report was traced to formatting patterns resembling an Opus model output tied to a $5,000-$10,000 payout. Teams managing bug bounty programs can watch how AI is reshaping submission quality and volume on daily.dev."}}]} ```