With the uptake of AI coding agents, and all the other AI capabilities, more people have been floating the idea of 100% secure software. I would argue that there is no such thing as 100%, due to a lot of factors, but I wanted to talk a little bit about how we may get closer.
Use of AI
The interesting thing that AI brings to the table is the ability to create agents with skills focused on being able to assess the security of the code written by another agent, and work together to remediate the issues. Imagine, two agents working together to go back and forth writing, assessing, and remediating the code, all without any human interaction.
The ability for these security agents to identity risks really relies on what they are aware of, whether that is through just general knowledge found on the web or through specific skills focused on security. Security, even SAST, can be very context specific. Is it web, mobile, API, OT, etc? All of these have different nuances where there may be some cross over of vulnerabilities, but also many unique issues. Applying web risks to a mobile or desktop code base will not be very efficient.
Commonly we focus on OWASP Top 10, but that isn’t the whole story. If we are talking 100% secure, we would have to cover the full CWE list. At this time, OWASP Top 10 (for web) only covers about 1/3 of that list. Heck, it doesn’t even cover the full top 25 CWEs. Applying the wrong source to the application also leaves large gaps.
We have to start training the skills and agents on more than just the OWASP Top 10 and be specific to the context of the type of application. CWEs are well documented and could easily be added as a source to the agent. Many programming languages also have pages set up that describe security risks or best practices. Incorporating these into the knowledge base can help the agents adhere to secure requirements.
More Findings
Opening up the scope of security risks will surely lead to more findings. There are currently a lot of CWEs that are not looked for because of the focus on the Top 10 lists. Of course, by the nature of the top 10’s, these other CWEs are either less common or less risky. However, if they are a CWE, they are a security risk of some sort and if we are looking for 100% secure, that means they have to be resolved as well, right?
Fortunately, if the interactions are all self contained between the agents working to write and fix the code, this shouldn’t cause any additional human effort. Well, with the exception of creating the skills or prompts to get the right coverage. The biggest cost difference will be the tokens to run the agents.
100% Secure, Really?
Even if you are able to provide all the right resources and the agents can work out all those details, does that really make the code 100% secure? That brings us to the “is anything really 100% secure” debate. Security is based more on the idea that I can prove it is vulnerable but hard to prove it is not. There may be test cases we didn’t run or scenarios we didn’t even know about. At best, you could say it is secure right now, but that is a stretch.
I think there will still be things that a human may find that AI doesn’t see, at least at this time. Of course, the same could be said about AI finding many things a human doesn’t see. There is no doubt that AI is finding things faster than a human ever could. I think there are still small nuances to some flaws that AI may struggle with.
I don’t think you can really get to 100% secure, but we are getting closer. Now the question changes to if you are not 100% secure are you secure at all? Maybe a great philosophical discussion for another time.