Burning Down The Backlog At Machine Speed: Why We Built ArmorCode Zero
Ask a security team how many open findings they have, and the answer usually comes with a pause. Hundreds of thousands. In a large enterprise, millions. Frontier LLM models have disrupted the cybersecurity industry. Time to exploit has reduced from years to hours. Attackers are using agents to exploit vulnerabilities at machine speed while defenders are still remediating at human speed with the same resources. There is a tsunami of vulnerabilities, and the backlog is growing with the next breach vector likely buried inside. Global cybersecurity and risk management leader and ArmorCode board member, Phil Venables described the moment well in a recent essay: “We’re clearly going to be in a race to respond at machine speed to machine speed attacks.”
I believe we are at the start of a new era in how defenders do their work. The tools, habits and metrics that got us here were built for a slower world.
Introducing ArmorCode Zero
Today we are introducing ArmorCode Zero, a different way for defenders to burn down AI-scale backlogs. With Zero, security teams collaborate with an agent and work through findings and fixes. Zero is built on top of the platform that is already battle-tested at the most demanding scale. We process more than 400 Billion findings a year, 1 Billion MCP & API calls, 1 Billion + agentic actions by 100,000+ agents deployed across the enterprise customer base. With ArmorCode Zero we saw the opportunity to create a fundamentally different experience to leapfrog the way defenders match the speed and accuracy this era demands.
ArmorCode Zero is built around a different scoreboard: is the backlog going down, and is the risk that matters most going down first? The name reflects the direction we want every backlog to head.
Fixes, not findings
For a long time our industry has measured itself by what it finds. More scanners, more coverage, more alerts. A finding has no value on its own. It is a cost to the business until someone fixes it.
Zero reads every finding and writes the triage call before anyone opens it. Then it groups findings by the change that resolves them, because one dependency upgrade can clear dozens of findings that used to show up as dozens of tickets. In our own testing on a tenant with about 28,600 findings, that turned the list into about 8,900 fixes, 69 percent fewer things to work on, ranked by the risk each one removes.
When you say yes to a fix, Zero drafts the change with the coding agent your engineers already use, such as Claude Code, Codex or Muse Code, and opens a draft pull request. Then it partners with a human on the loop to approve it. A fix counts only when ArmorCode rescans the exact commit and the finding is gone. If a finding turns out to be a false positive, Zero saves the evidence. Every finding becomes a fix, and every fix is proven.
AI is the new UI; Context is king; Inference is in.
In today’s agentic world, every platform will have more agentic actions, connections, and communication than humans. We need to look at everything from an AI-Native mindset.
A dashboard answers questions someone decided to ask months ago. It shows what happened. It leaves the hard part, deciding what to do, to a person with too little time and too much data.
With the ArmorCode platform and foundation in place, we could build Zero so that you ask, suggest, or respond, an agent does the legwork, and you decide. Your chats have more context and sit beside every page. Zero changes the way you handle exposures as a defender and how you use the ArmorCode platform.
Context changes that. A critical CVE on an isolated test server and the same CVE on an internet-facing payment service are two very different problems. Telling them apart requires knowing the asset, its exposure, its owner, the business service it supports and the controls around it. With that context in place, the system can infer what matters now and what to do about it. And when you do want a chart, you describe it in plain words and Zero builds it.
Toward autonomic security
Phil Venables, recently published Autonomic Defense: Countering AI-Driven Offense at Machine Speed. It is worth reading in full. His core point is that speed alone will not be enough. Attackers using AI can generate a huge variety of exploit paths, and a defense built on static playbooks will fall behind no matter how fast it runs. Defenders need systems that can generate new responses, and keep learning, within limits people set.
The model he points to comes from IBM’s 2001 work on autonomic computing: systems that configure, heal, optimize and protect themselves, much like the body’s autonomic nervous system. At the center is a control loop called MAPE-K. Here is how it maps to exposure management at ArmorCode:
- Monitor: take in findings continuously from the hundreds of tools our customers already run, aggregated and deduplicated in ArmorCode.
- Analyze: summarize and triage every finding, with a recommendation, a confidence level and what to confirm.
- Plan: group findings by the change that resolves them and rank those fixes by the risk they remove.
- Execute: draft the fix with the team’s own coding agent, open a pull request for review, and rescan the exact commit to prove the result.
- Knowledge: the shared base of context that informs every other step and grows with each fix.
For us, Knowledge is the ArmorCode Context Risk Graph. It connects findings to assets, code, owners, business context, services, and controls across an enterprise. It is the hardest part of this loop to build, because it depends on years of integrations and data from real production environments. It is also what makes good inference possible. Without it, AI can only guess. But with it, AI can reason about a specific environment.
An autonomic system still answers to people. In Zero today, every consequential change is a card you can edit, confirm or undo. Secrets are redacted before any model call, and you can bring your own model keys. The rescan, run by the scanner and recorded in ArmorCode, is what proves a fix worked.
That is where we are starting, on purpose. Trust in an autonomic system is earned one verified fix at a time. As teams see the evidence pile up, they will be able to widen what Zero handles on its own, within risk tolerances and boundaries they set. That is how a small team can oversee work at a scale that would otherwise take a much larger one.
Where we go from here
Zero is the next step on a path we have been building toward for years. First we unified security data from hundreds of tools into one system of record. Then we built the Context Risk Graph to understand how that risk connects to the business. Zero puts both to work in one place, focused on the result that counts.
For a CISO, that means fixes ranked by risk removed and proven by rescan, with every AI action behind a confirmation. For a vulnerability management lead, it means a short list of fixes in place of a growing pile of findings. For a developer, it means a draft pull request with the reasoning and scan results attached, in place of a vague ticket.
We are opening Zero to a limited group of customers first, because we want to learn from teams running it on real backlogs. We are not going to show everything today. You can watch a short walkthrough, and if you want to see more, register there for early access. We will also share a preview at this week’s Agentic AI Conference hosted by The Purple Book Community and sponsored by ArmorCode.
The volume and velocity of risk will keep rising. Defenders now have a way to keep pace at AI scale. Fixes are what count, and that is the backlog we built Zero to take to zero.
