How Cúram is using AI to strengthen open-source software security analysis

Open-source software (OSS) powers nearly every modern enterprise application. It allows development teams to build on proven technologies rather than reinventing foundational capabilities, accelerating innovation and helping organizations deliver software more efficiently.

For software teams, however, OSS also introduces responsibility. Every open-source component must be monitored for newly discovered vulnerabilities, assessed for relevance, and remediated when necessary. As applications grow more complex and dependencies increase, understanding how a vulnerability actually affects a product can become just as important as identifying the vulnerability itself.

At Cúram, we’re using AI to make that process faster, more thorough, and more scalable. By combining vulnerability intelligence, repository analysis, and AI-driven assessment, our security and development teams can move from vulnerability detection to actionable remediation guidance more quickly while maintaining the governance, validation, and security rigor our customers expect.

The challenge: finding a vulnerability is only the first step

Security tools continuously scan software components for known vulnerabilities. When a vulnerability is discovered, it is typically assigned a CVE, or Common Vulnerabilities and Exposures identifier, which serves as a standardized way for the security community to track and discuss specific security issues. Public databases such as the National Vulnerability Database provide detailed information, severity scores, affected versions, and remediation guidance.

But that information answers only part of the question. When a vulnerability is identified, development and security teams still need to determine:

• Is the vulnerable component present in the product?
• Which versions are affected?
• Is the vulnerable functionality actually being used?
• Is the affected code reachable within the application’s architecture?
• Are mitigating controls already in place?
• What specific changes are required to remediate the issue?
• How should the vulnerability be prioritized relative to other work?

These answers often require teams to gather information from multiple sources, review repositories, inspect configurations, trace dependencies, validate code paths, and document findings. The process is essential to secure software development, but it can also be time-consuming.

Adding complexity, vulnerability severity and actual product risk are not always the same thing. A vulnerability may receive a high severity score in a public database, but factors such as implementation, configuration, usage patterns, and application architecture can significantly influence its impact within a specific product environment.

How AI improves the process

To help streamline this work, Cúram has incorporated AI into its vulnerability review workflow. The process combines information from public vulnerability intelligence sources with evidence gathered directly from product code repositories. Rather than requiring our security team to manually pull information from multiple databases, search repositories, validate versions, review configuration files, and assemble findings independently, AI helps organize and analyze that information in a structured and repeatable way.

The resulting analysis can provide:

• Vulnerability details and affected versions
• References from industry security databases
• Repository evidence showing where affected components exist
• Configuration and version tracking information
• Exploitability and reachability analysis
• Recommended remediation actions
• Validation and closure criteria

Bringing these insights together allows our teams to move more quickly from investigation to action while ensuring decisions are supported by documented evidence.

The approach also helps provide a more complete view of risk. In addition to traditional measures such as CVSS severity scores, the analysis can incorporate exploitability data, runtime evidence, repository findings, configuration details, and other contextual information that helps our security team understand how a vulnerability applies within the product environment.

Rather than treating every vulnerability as a generic security alert, our security team gains a product-specific assessment that helps them focus on what matters most.

Built with governance and safeguards

As AI becomes more integrated into software development processes, transparency remains essential. The objective is not to replace human judgment, but to provide security and development teams with better and more complete information so they can make decisions quickly and confidently.

Cúram’s process therefore combines automation, AI-driven analysis, and human review. Repeatable tasks such as repository searches, dependency resolution, file analysis, and evidence collection are handled through automation. AI is then used to connect findings across multiple sources, assess applicability, and generate structured recommendations for developers and security teams.

The outputs also include documentation that supports traceability and governance, including:

• Review requirements
• Validation checkpoints
• Closure criteria
• Supporting references
• Security sign-off requirements

Security professionals and development teams continue to review findings, validate remediation activities, and approve closure before vulnerabilities are considered resolved. AI accelerates the process, but accountability and oversight remain firmly in human hands.

Delivering better outcomes for customers

The most immediate impact has been speed. By automating evidence gathering and vulnerability analysis, Cúram’s security professionals have significantly reduced the effort required to assess open-source vulnerabilities. Work that previously required days or weeks of manual analysis can often be completed in hours or minutes.

The benefits extend beyond efficiency:

• More comprehensive evidence collection
• Faster identification of affected components
• Improved consistency across vulnerability reviews
• Clearer remediation guidance for developers
• Better documentation for governance and compliance
• Stronger understanding of product-specific risk

For Cúram customers, the value is straightforward. AI is helping our teams assess vulnerabilities more quickly, make better-informed security decisions, and devote more effort to remediation rather than manual investigation.

This is one example of how Cúram is applying AI within its engineering organization. Not as a replacement for established security practices, but as a way to strengthen them. By combining automation, AI-driven analysis, and engineering expertise, we’re helping teams work more efficiently while maintaining the security, governance, and rigor required to deliver secure, reliable software.