itssujeeth Senior Expert Software Engineer (Enterprise Architecture, Director) · 2023 In progress at departure
GenAI Automated CVE Fixer
A GenAI-assisted approach to remediating known security vulnerabilities across an enterprise codebase, budgeted at a fraction of the manual estimate and in progress when I left.
Security teams at a Fortune-class logistics enterprise were manually triaging and patching CVEs across a large codebase. It was slow and repetitive work that left exposure windows open longer than acceptable.
Designed the GenAI-assisted remediation approach: the model proposes fixes for affected code, and every change goes through the existing review and CI gates with a human deciding. Made the business case against the organization's manual remediation estimate and led the work while it ran.
Projected: the organization estimated manual remediation at about $1.3M; the automated approach was budgeted at about $300K, an expected saving of about $1M. Measured at my departure in March 2024, with the work still in progress: vulnerability coverage on the portion remediated had improved by about 50%. I do not claim the full saving was realized.
The core design bet was pairing LLM generation with deterministic guardrails: the model proposes remediations, but every change still flows through the organization’s normal review and CI gates rather than being applied blindly. That boundary is what made it deployable in an enterprise security context rather than a demo.
The value isn’t novelty. It’s taking a high-volume, low-judgment task off security engineers’ plates and compressing the exposure window between CVE disclosure and patched deployment. The numbers carry their labels. $1.3M was the organization’s own estimate of manual remediation. The automated approach was budgeted at about $300K, so the expected saving was about $1M. I left in March 2024 while the work was in progress, and by then coverage on the remediated portion had improved by about 50%. Whether the full saving was realized after that, I cannot say.
This was also the first use of generative AI for code modification at the organization, which meant the governance framing (human review gate, audit trail, rollback path) was as much the deliverable as the model itself.