Kodem just built the world’s only Dev to Prod Agentic Taskforce in Cyber
AppSec is structurally constrained. Codebases are doubling. Vulnerabilities are compounding. But the number of security engineers capable of triaging, validating, and fixing them is flat, at best.
At RSAC 2025, we launched Kai, the first AI-native application security engineer. Today, we’re expanding it into a fully agentic task force that truly performs AppSec tasks from start to finish.
Kai has evolved from a single agent to a persistent system that scans, manages, and defends applications with the precision and scale that modern environments demand.
The Structural Problem in AppSec
Software release velocity has increased 5–10× over the past decade, driven by microservices, continuous deployment, and open-source adoption. Each deploy potentially exposes a new attack path. Vulnerabilities, especially in dependencies, have scaled alongside.
But AppSec headcount has not.
- Open source is the new default. Snyk data shows that 80–90% of a typical codebase is third-party packages (Snyk, 2023).
- Vulnerability volume is exploding. NVD added over 29,000 CVEs in 2024, and over 60% were tied to libraries or supply chain dependencies.
- Patch cycles are getting slower. Recent research shows median time to remediate critical vulns in large orgs exceeds 120 days (Veracode, 2023).
- Security expertise is lagging. According to ESG (2024), 71% of organizations report an AppSec talent gap.
The result is predictable: growing backlogs, alert fatigue, and long windows of exposure, even in teams with decent tooling.
A Shift in the Market: From CVSS to Exploitability
Traditional security tooling prioritizes findings using static CVSS scores. But these do not reflect exploitability in your specific environment.
In 2024 and 2025, multiple signals confirm that the market is now pivoting to reachability, runtime validation, and blast radius.
- FedRAMP CVM RFC 0012: Draft guidelines now explicitly recommend prioritizing vulnerabilities not by CVSS, but by "contextual risk"—including exploitability, reachability, and runtime exposure (FedRAMP, 2024).
- Gartner Hype Cycle for Application Security, 2025: “Reachability Analysis” is highlighted as a high-benefit innovation nearing mainstream adoption. Gartner defines it as “dynamic prioritization using organizational context,” and states that tools that fail to include it will soon be considered outdated (Zumerle et al., 2025).
Practitioners are already there.
“Take the pile of vulnerabilities and make it smaller. That’s the job.”
— Nir Rothenberg, CISO @ Rapyd
“Reachability is about knowing where you’re actually vulnerable.”
— James Berthoty, Kubernetes security researcher
Enter Kai: From Solo Agent to Task Force
Most AI initiatives in security so far are static overlays on static tools: LLMs summarizing scanner output or explaining CWE IDs. Useful, but not scalable.
Kai takes a different approach. It is a multi-agent system built on Kodem’s runtime-aware, eBPF-enabled platform. Each agent solves a specific problem in the AppSec lifecycle. Together, they operate as a persistent force.
What Kai’s Agentic Task Force Can Do
All agents are coordinated via a shared attack map, continuously updated based on code, container, and runtime telemetry.
Why Agentic AI Is the Right Primitive for AppSec
AppSec work is bounded and repeatable:
- Find what matters (scan)
- Confirm it matters (validate)
- Resolve it or escalate (fix/alert)
This pattern is ideal for agents—not general AI assistants.
A monolithic AI cannot reason about blast radius while doing remediation. A task force can. Kai distributes reasoning across specialized agents, enabling parallel action and contextual awareness that static tools lack.
Most importantly, Kai acts. It does not wait for human input to reduce risk.
Early Results
Teams using Kai in design partner programs are seeing measurable outcomes:
- Backlog reduction: One fintech saw their open criticals drop from 1,240 to under 100 in 30 days
- MTTR drop: Median time to remediate reachable vulnerabilities went from 45 days to 4
- Operational overhead: ADR documentation that used to take 2 hours is now fully automated
And when a high-severity memory exploit surfaced in a third-party component, Kai's runtime agent caught it—before a single human alert fired.
What's Next: Meet Kai at Black Hat USA
If the industry is moving away from CVSS and toward attacker-aware prioritization, security teams will need systems that can operate with the same assumptions.
Kai is the only agentic AI task force that scans, manages, and defends applications autonomously.
We’ll be at Black Hat USA here: https://www.kodemsecurity.com/lp/black-hat-2025
Meet us for a live demo, technical deep dive, or early access to Kai’s persistent agents.
Join the Kai Waitlist
References
- FedRAMP. (2024). RFC-0012: Continuous Vulnerability Management (CVM) Baseline Guidance. Retrieved from https://www.fedramp.gov/rfcs/0012/
- Gartner. (2025). Hype Cycle for Application Security, 2025 (Zumerle, D., et al.). Gartner, Inc.
- Snyk. (2023). State of Open Source Security. Retrieved from https://snyk.io
- Veracode. (2023). State of Software Security, Volume 12. Retrieved from https://info.veracode.com
- ESG. (2024). The Life and Times of Cybersecurity Professionals. Retrieved from https://www.enterprisestrategygroup.com
{{kai-section="/314695942731"}}
More blogs
From Discovery to Resolution: A Single Source of Truth for Vulnerability Statuses
Continuous visibility from first discovery to final resolution across code repositories and container images, showing who fixed each vulnerability, when it was resolved and how long closure took. Kodem turns issue statuses into ownership for engineers, progress tracking for leadership and defensible risk reduction for application security.
Kai Gets Internet Access: Turning Context Into Intelligence for Product Security Teams
For years, product security teams have lived with a gap. Tools surfaced findings — CVEs, outdated packages, risky dependencies — but rarely the context to make sense of them. Engineers still had to open a browser, type a CVE into Google, skim through NVD, vendor advisories, GitHub issues, and random blogs to answer basic questions: Is this actually exploitable in our environment? Is there a safe upgrade path? Has anyone seen this exploited in the wild? This release closes that gap.
When NPM Goes Rogue: The @ctrl/tinycolor Supply-Chain Attack
On September 15, 2025, researchers at StepSecurity and Socket disclosed a large, sophisticated supply-chain compromise in the NPM ecosystem. The incident centers around the popular package @ctrl/tinycolor (with over two million weekly downloads), but it extends far beyond: 40+ other packages across multiple maintainers were also compromised.
A Primer on Runtime Intelligence
See how Kodem's cutting-edge sensor technology revolutionizes application monitoring at the kernel level.
Platform Overview Video
Watch our short platform overview video to see how Kodem discovers real security risks in your code at runtime.
The State of the Application Security Workflow
This report aims to equip readers with actionable insights that can help future-proof their security programs. Kodem, the publisher of this report, purpose built a platform that bridges these gaps by unifying shift-left strategies with runtime monitoring and protection.
.png)
Get real-time insights across the full stack…code, containers, OS, and memory
Watch how Kodem’s runtime security platform detects and blocks attacks before they cause damage. No guesswork. Just precise, automated protection.
Stay up-to-date on Audit Nexus
A curated resource for the many updates to cybersecurity and AI risk regulations, frameworks, and standards.