Why Frontier AI Raises The Standard For Software Assurance

James Patrick-Evans, founder and CEO of RevEng.AI.

gettyAI is changing the rules of cybersecurity, one breakthrough at a time. Advances are coming fast as frontier models take greater leaps forward, with dangerously unpredictable consequences for businesses, as demonstrated by the OpenAI and Hugging Face incident.

Security experts warn of a near-future where threat actors could automate the full intrusion life cycle, overwhelming network defenders. They’ve already shrunk the exploitation window to just hours with the help of AI, according to Synack research cited by Help Net Security.

Yet while the technology is creating new problems, it’s also becoming part of the solution. Frontier AI represents a step change in how machines can understand, reason about and analyze software. That’s an exciting prospect for organizations grappling with the growing software supply chain risk.

Every major technological breakthrough eventually raises the baseline of customer expectations. What starts as cutting-edge becomes standard practice.

Take cloud computing. In the days of client-server computing, organizations had to buy and install servers in data centers, predicting demand months or years ahead. Cloud computing dramatically improved business agility by providing scalable, on-demand infrastructure.

DevOps has been similarly transformative. There was a time when software releases happened only every few months after extensive, manual testing cycles. Today’s CI/CD pipelines enable rapid testing and allow deployment up to several times per day in some cases.

Frontier AI will have a similarly dramatic impact on software assurance. It’s already changing the economics of software analysis, executing tasks that were previously too slow, expensive or specialized to apply. Previously, reverse engineering and assessing critical software could take weeks to months for a single application.

Advances in AI models trained specifically to understand binary machine code, for instance, are helping automate this process. These models can reconstruct source code, analyze software behavior and identify potential security risks directly from compiled applications, even when the original source code is unavailable. This reduces the manual effort traditionally required for reverse engineering and makes deeper software analysis practical at a much greater scale.

Software supply chains are a growing source of enterprise risk. Threat actors are increasingly targeting third-party dependencies and their CI/CD pipelines to distribute malicious updates, compromise dependencies and build systems.

They might even upload malicious packages and wait for a developer to download them. A Sonatype study covered in Infosecurity Magazine shows nearly half a million such packages were discovered last year, with these actions becoming “sustained, industrialized campaigns.”

AI coding agents threaten to compound these risks because they’re creating code, updating dependencies and refactoring applications at machine speed. One study by researchers from the Massachusetts Institute of Technology and the Wharton School of Business found that AI coding agents increased code output per developer by 741%, leading to a 20% increase in software releases.

Modern applications increasingly rely on code created outside of the organization, commercial software and third-party components, as well as AI-generated code.

Together, these create complex software ecosystems that traditional static application security testing (SAST) and dynamic application security testing (DAST) solutions were not meant to secure.

According to JPMorgan, an estimated 77% of code consists of reused dependencies and libraries. If trusted and secured source code isn’t available for every component in your software supply chain, you potentially have a threat or backdoor in your organization without knowing it.

The result is that organizations simply don’t know if they can trust the software they’re running. They cannot trust that it doesn’t steal private information, that it was built to high security standards, or that it doesn’t introduce new threats.

Can developers trust the software they put into production? Does it contain any malicious code, or will it perform any unwanted or hidden actions at runtime?

These are the questions security practitioners desperately need answers to.

Advances in frontier AI are making a deeper understanding of software practical at enterprise scale, creating an opportunity to rethink what software assurance can achieve.

AI-assisted analysis, for instance, can help organizations assess software against human-understandable security policies, identify potentially malicious functionality and better understand how applications behave without requiring detailed knowledge of their underlying code.

My company, RevEng.AI, develops specialized AI models for analyzing compiled software, including binaries and firmware. But this is part of a broader shift toward AI-assisted software verification, where advances in automated code analysis, vulnerability discovery and software behavior analysis are helping organizations better understand the applications they depend on.

The truth is that traditional source code analysis alone is no longer enough and dynamic analysis isn’t going to catch what isn’t easily triggered at runtime.

Vulnerabilities, hidden functionality or malicious modifications can also be introduced during the build process. Analyzing the executable itself is essential for verification, helping organizations understand what actually ends up running on a user’s machine.

Organizations adopting these capabilities can gain greater confidence in applications they previously had to trust without verification, making more informed decisions before software is shipped, procured, deployed or updated.

Binary analysis is not a replacement for SAST or DAST. Each provides different visibility into software risk, and combining them offers a more complete picture.

Challenges also remain, particularly when analyzing heavily obfuscated code or interpreting complex software behavior. Likewise, AI-generated findings require validation, as no single technique can guarantee that software is free from vulnerabilities or malicious functionality.

The convergence of frontier AI and increasingly complex software ecosystems is redefining what software assurance looks like. Security leaders should look beyond SAST and DAST alone, incorporating analysis of the final binary artifacts that run on their systems to strengthen software verification.

This once expensive security practice, traditionally concentrated among organizations with significant resources, is becoming accessible to a broader range of businesses.

As these capabilities become more accessible, customers, regulators, boards and developers will expect greater confidence in the software that organizations build, buy and deploy. It’s long past time to close the software assurance gap.​​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?