How Mandiant’s AVDH Shows the New Shape of AI Cybersecurity

Mandiant’s Agentic Vulnerability Discovery Harness (AVDH) points to a more important development than any single vulnerability count: AI-assisted security research is becoming an engineered workflow rather than a chatbot experiment. The system combines specialized agents, human threat-model review, exploit-path analysis, independent validation, and consultant-reproduced proof-of-concept exploits. In one incident-response engagement, Google said it found more than 100 true-positive, high-severity vulnerabilities in two days.

That result is impressive, but it should not be read as evidence that one model can simply “read all code.” AVDH’s apparent advantage comes from dividing vulnerability research into stages, narrowing a huge search space, and using human experts as a quality gate before a suspected flaw becomes a security finding.

AVDH is a pipeline, not a single AI reviewer

The architecture described for AVDH follows the logic of an experienced security assessment. Agents first help establish what a codebase does and how it may be attacked. Other stages map the attack surface, identify entry points, trace data flows, generate competing vulnerability hypotheses, and validate proposed exploit paths. Human consultants review the threat model and reproduce proof-of-concept exploits before findings are treated as verified.

This division of labor matters because source-code analysis produces far more suspicious patterns than security teams can investigate manually. AVDH can generate a large volume of intermediate findings, while the validation stages and human review concentrate attention on issues that appear exploitable and consequential.

Google said that, during its first 10 months of use, AVDH analyzed codebases spanning tens of millions of lines and produced tens of thousands of findings. In the highlighted two-day investigation, the system identified more than 100 true-positive critical vulnerabilities. The broader work has also contributed to 12 assigned CVEs, with roughly another dozen issues reportedly still under active disclosure.

The useful measure is therefore not the raw number of alerts. It is the conversion rate from machine-generated hypotheses into reproducible, responsibly handled vulnerabilities.

Why AVDH and Palo Alto’s NOVA are not a clean competition

Palo Alto Networks has reported a much larger headline number from NOVA, its autonomous multi-model vulnerability discovery system. In two months, NOVA analyzed 3,915 open-source projects and reported 14,090 confirmed vulnerabilities; 99.4% were previously unreported and 40% were rated high or critical, according to Palo Alto’s research.

Those figures describe a different operating model from Mandiant’s AVDH result:

• AVDH: a time-bounded, deeply investigated assessment connected to incident response, with human review and reproduced exploit paths as important quality controls.
• NOVA: an ecosystem-scale scan across thousands of open-source projects, optimized for breadth and autonomous discovery.

The available reports do not establish that the two systems used identical target selection, severity criteria, false-positive thresholds, exploitability tests, or disclosure processes. Their headline numbers should therefore not be treated as a universal leaderboard. AVDH demonstrates how agent chains can support high-confidence investigation in a specific engagement; NOVA demonstrates the scale at which autonomous discovery can operate across open-source software.

Together, the results suggest that vulnerability discovery is splitting into two problems: searching broadly enough to find weaknesses and validating them well enough to make the findings actionable.

The response is moving from discovery to exposure reduction

Palo Alto’s answer to faster discovery is not limited to finding flaws. Its Advanced Virtual Patching proposal aims to deploy network-level protections within hours, reducing exposure while software owners work through conventional remediation. Palo Alto contrasts that approach with an industry-average traditional patching interval of about 55 days.

The company has also announced the Frontier AI Critical Defense Program, which brings AI companies, software providers, open-source participants, and operational-technology organizations into a coordinated defense effort. Reported participants include Anthropic, OpenAI, IBM, Red Hat, Microsoft, Siemens, Mitsubishi Electric, and Axis Communications, among others.

Virtual patching can be valuable when a vulnerable service is reachable through traffic that a network control can identify and block. It is best understood as a compensating control, however, not as a substitute for correcting the underlying software. The durable fix still requires an owner to understand the vulnerability, implement a code change, test it, distribute it, and confirm that affected systems have received it.

That distinction becomes more important as discovery accelerates. A network control may reduce immediate exposure, but it does not by itself resolve vulnerable code throughout an application or software supply chain.

Attackers are gaining the same acceleration

The defensive progress is unfolding alongside evidence that attackers are using AI for similar tasks. Google’s Threat Intelligence Group reported what it described as the first identified case of a threat actor using a zero-day exploit believed to have been developed with AI. The actor planned to use the exploit in a wide-scale attack, which Google said its counter-discovery helped prevent.

The reported exploit targeted a two-factor-authentication bypass in a popular open-source web administration tool. Analysis cited indicators including educational comments and a hallucinated CVSS score as evidence that an AI model had likely assisted its development.

This does not mean every AI-generated vulnerability becomes an operational attack. It does mean that defenders can no longer assume code complexity, limited researcher capacity, or a long gap between discovery and exploitation will reliably provide time to respond.

The Cloud Security Alliance’s warning is consequently central: AI is increasing the speed and scale of vulnerability discovery faster than many disclosure and patching systems can absorb. More findings can improve security only if organizations have the capacity to triage, coordinate disclosure, build fixes, and deploy protections safely.

Can defenders regain the advantage?

Yes—but not by purchasing a vulnerability-finding model alone. The advantage belongs to organizations that connect discovery to the rest of the security operating system:

1. Threat modeling narrows the search toward realistic attack paths.
2. Agentic analysis explores code and generates competing hypotheses at machine speed.
3. Independent validation reduces the chance that suspicious patterns become misleading reports.
4. Human reproduction confirms whether a proposed flaw can actually be exploited.
5. Coordinated disclosure gives maintainers and vendors a path to respond.
6. Virtual patching and other compensating controls reduce exposure while a code fix is being prepared.
7. Prioritized remediation ensures that the most reachable and consequential vulnerabilities are fixed first.

AVDH illustrates the value of this connected workflow: broad automated exploration is paired with human judgment and exploit verification. NOVA illustrates the pressure the workflow must handle: autonomous discovery can produce findings at a scale that traditional security teams were not designed to process.

The emerging AI cybersecurity arms race is therefore not simply a contest over which model finds the most bugs. It is a race to complete the entire detect-to-mitigate loop faster than an adversary can turn a vulnerability into an attack. Defenders can gain ground where they control the code, deployment pipeline, telemetry, and network controls—but discovery without validation, ownership, disclosure, and remediation may increase the size of the problem rather than solve it.