Open-source software (OSS) powers nearly every modern enterprise application. It allows development teams to build on proven technologies rather than reinventing foundational capabilities, accelerating innovation and helping organizations deliver software more efficiently.
For software teams, however, OSS also introduces responsibility. Every open-source component must be monitored for newly discovered vulnerabilities, assessed for relevance, and remediated when necessary. As applications grow more complex and dependencies increase, understanding how a vulnerability actually affects a product can become just as important as identifying the vulnerability itself.
At Cúram, we’re using AI to make that process faster, more thorough, and more scalable. By combining vulnerability intelligence, repository analysis, and AI-driven assessment, our security and development teams can move from vulnerability detection to actionable remediation guidance more quickly while maintaining the governance, validation, and security rigor our customers expect.
Security tools continuously scan software components for known vulnerabilities. When a vulnerability is discovered, it is typically assigned a CVE, or Common Vulnerabilities and Exposures identifier, which serves as a standardized way for the security community to track and discuss specific security issues. Public databases such as the National Vulnerability Database provide detailed information, severity scores, affected versions, and remediation guidance.
But that information answers only part of the question. When a vulnerability is identified, development and security teams still need to determine:
These answers often require teams to gather information from multiple sources, review repositories, inspect configurations, trace dependencies, validate code paths, and document findings. The process is essential to secure software development, but it can also be time-consuming.
Adding complexity, vulnerability severity and actual product risk are not always the same thing. A vulnerability may receive a high severity score in a public database, but factors such as implementation, configuration, usage patterns, and application architecture can significantly influence its impact within a specific product environment.
To help streamline this work, Cúram has incorporated AI into its vulnerability review workflow. The process combines information from public vulnerability intelligence sources with evidence gathered directly from product code repositories. Rather than requiring our security team to manually pull information from multiple databases, search repositories, validate versions, review configuration files, and assemble findings independently, AI helps organize and analyze that information in a structured and repeatable way.
The resulting analysis can provide:
Bringing these insights together allows our teams to move more quickly from investigation to action while ensuring decisions are supported by documented evidence.
The approach also helps provide a more complete view of risk. In addition to traditional measures such as CVSS severity scores, the analysis can incorporate exploitability data, runtime evidence, repository findings, configuration details, and other contextual information that helps our security team understand how a vulnerability applies within the product environment.
Rather than treating every vulnerability as a generic security alert, our security team gains a product-specific assessment that helps them focus on what matters most.
As AI becomes more integrated into software development processes, transparency remains essential. The objective is not to replace human judgment, but to provide security and development teams with better and more complete information so they can make decisions quickly and confidently.
Cúram’s process therefore combines automation, AI-driven analysis, and human review. Repeatable tasks such as repository searches, dependency resolution, file analysis, and evidence collection are handled through automation. AI is then used to connect findings across multiple sources, assess applicability, and generate structured recommendations for developers and security teams.
The outputs also include documentation that supports traceability and governance, including:
Security professionals and development teams continue to review findings, validate remediation activities, and approve closure before vulnerabilities are considered resolved. AI accelerates the process, but accountability and oversight remain firmly in human hands.
The most immediate impact has been speed. By automating evidence gathering and vulnerability analysis, Cúram’s security professionals have significantly reduced the effort required to assess open-source vulnerabilities. Work that previously required days or weeks of manual analysis can often be completed in hours or minutes.
The benefits extend beyond efficiency:
For Cúram customers, the value is straightforward. AI is helping our teams assess vulnerabilities more quickly, make better-informed security decisions, and devote more effort to remediation rather than manual investigation.
This is one example of how Cúram is applying AI within its engineering organization. Not as a replacement for established security practices, but as a way to strengthen them. By combining automation, AI-driven analysis, and engineering expertise, we’re helping teams work more efficiently while maintaining the security, governance, and rigor required to deliver secure, reliable software.