Using AI to Find What Actually Matters in Security Testing
Using AI to Find What Actually Matters in Security Testing is a Cloud Security Alliance Agentic AI Summit session by Daniel Cuthbert on RAPTOR, an autonomous offensive and defensive security research framework. The useful problem statement is simple: modern scanners are good at producing findings, but weak at answering the operator's next question. Which findings are reachable, exploitable, important, reproducible, and fixable today?
The Apache HTTP Server 2.0.35 example gives the talk its shape. Cuthbert describes RAPTOR starting with 606 raw findings, validating a much smaller set, identifying one critical exploitability path, generating proof-of-concept behavior, and then moving toward patch suggestions. The exact result should be treated as a demo claim rather than independent validation. The important move is methodological: the output is not only "this looks vulnerable." It is an attempt to connect untrusted input, entry point, trust boundary, sink, preconditions, mitigations, exploit behavior, and remediation evidence.
RAPTOR's own documentation describes the same lifecycle: static analysis with Semgrep and CodeQL, binary fuzzing with AFL++, exploit generation, patch creation, validation, and agentic orchestration. The GitHub README frames RAPTOR as a workflow that chains static analysis, binary analysis, LLM-powered vulnerability validation, exploit generation, and patch writing. That belongs beside The Cyber Agent Becomes the Bug Hunter, AI in Cybersecurity, AI Red Teaming, and Anthropic's Project Glasswing.
The strongest concept is evidence over alert volume. A security agent that merely rephrases scanner output is a confidence amplifier. A useful security agent has to preserve a source-to-sink trace, explain why false positives were rejected, state exploitability assumptions, keep reproduction artifacts, propose patches, and produce records that humans can audit. That links the session to Vulnerability Exploitability eXchange, Common Vulnerability Scoring System, AI Vulnerability Disclosure, Secure AI System Development, and AI Audit Trails.
The dual-use edge is unavoidable. A tool that can triage findings, validate exploitability, write proof-of-concept code, and suggest patches can help maintainers, security teams, researchers, and penetration testers. It can also lower the labor cost of offensive vulnerability discovery if run without scope, disclosure rules, sandboxing, or human review. CSA's AI Controls Matrix v1.1 is relevant here because it treats AI governance as control objectives, implementation guidance, and audit guidance rather than as a single model-safety promise.
Evidence and limits: this is a conference demo of an open-source security research framework, not a neutral benchmark proving RAPTOR's precision, recall, exploit reliability, patch quality, or safety under adversarial use. The GitHub project itself presents RAPTOR as useful but not polished software. The right reading is neither hype nor dismissal: AI-assisted exploitability validation is becoming operationally real, and the responsible record must include scope, environment, inputs, rejected findings, exploit evidence, patch review, disclosure path, and a human owner for every autonomous run.