Interesting development. I've been using AI to help with security checks on systems I actually run, including my Oracle server and a Kali test setup.
The biggest lesson so far is that identifying a possible vulnerability and proving you've improved security are two different jobs.
For example, an Nmap scan in my own Kali lab showed rpcbind exposed. I disabled both the service and its socket, then repeated the scan to confirm the port was no longer open.
That's what I'd want from an AI vulnerability scanner: clear evidence for each finding, a way to reproduce it, sensible prioritisation, human approval before anything changes, and a follow-up check to verify the fix.
If this makes open-source security work more accessible without creating a mountain of false positives, it could be genuinely useful. I'd be interested to see how reliably it separates actual risks from noisy findings.
Interesting development. I've been using AI to help with security checks on systems I actually run, including my Oracle server and a Kali test setup.
The biggest lesson so far is that identifying a possible vulnerability and proving you've improved security are two different jobs.
For example, an Nmap scan in my own Kali lab showed rpcbind exposed. I disabled both the service and its socket, then repeated the scan to confirm the port was no longer open.
That's what I'd want from an AI vulnerability scanner: clear evidence for each finding, a way to reproduce it, sensible prioritisation, human approval before anything changes, and a follow-up check to verify the fix.
If this makes open-source security work more accessible without creating a mountain of false positives, it could be genuinely useful. I'd be interested to see how reliably it separates actual risks from noisy findings.