AI Security: Humans Before The Loop

Software has flaws. Some flaws are just annoying bugs, like a ring bell that doesn't ring. Some flaws are security vulnerabilities, like a window latch that doesn't quite close. Similar to homes, software applications are built from thousands of different components, and new vulnerabilities are discovered in them every single day. Defense means finding and fixing all your unlatched windows before someone else finds them first. A successful attacker only needs to find one window with a flaw to get into the house, a defender has to ensure all windows around the house don’t have any flaws. That’s what makes cyber security defence so stressful and high stakes.

Vendors, like the manufacturers of the flawed window latch, are constantly revising their products to make them more secure. However, because software is just information on the internet, when a vendor fixes a software issue they publish detailed manuals on what changed from the old version to the new one. Everyone on the internet can see that manual if they know where to look. Smart thieves can see exactly what the vendor fixed and figure out how to jiggle the old windows to wiggle them open, and then open any window in any house that hasn’t fixed the vulnerability. Luckily, reverse engineering the vulnerability in the latch was not easy to do. It took many months of research to be able to figure out. That’s all changed, now it’s easier and cheaper than ever to reverse engineer those flaws. Security professionals track the median time between a vulnerability being fixed and the first observed attack using it. The trend line is not a gradual decline. It’s a total collapse:

In 2018, defenders had over two years to patch vulnerabilities before they were exploited by bad actors. Last year, we had three weeks. This year, we expect most vulnerabilities to be exploited within hours of a fix being announced by a vendor. The average organization still needs roughly 20 days to test and roll out a patch. Do the math: attacks now begin within hours, and defenses finish deploying weeks later. Monthly patch cycles, the industry standard for decades, have quietly become theater. What changed between 2018 and now? Machines learned to hack. In 2024, researchers at the University of Illinois showed that a large language model, given the description of a known flaw, could produce a working exploit 87% of the time for about $8.80 each. That same year, Google's "Big Sleep" project announced an AI had discovered a serious, previously unknown flaw in one of the most widely used databases on Earth before any human found it. Earlier this year, Anthropic reported its AI had found over 500 high-severity bugs in open-source software that had survived decades of expert review, and independent researchers were running AI swarms that found exploitable flaws for about $4 apiece.

How do you fight attackers that use autonomous AI to break into your systems at machine speed while ensuring the defending AI’s actions are constrained and vetted by a human? "Human in the loop" usually conjures a person clicking approve on every alert. At the speeds described above, the defending model is already dead. A human approval queue is just a slower way to lose and let’s face it, humans need sleep and machines do not. At Fullscript, we’re moving humans to where their judgment actually matters: the standards, not the buttons. Project Glycerin is our answer to this problem. It's an in-house AI system that reviews every security finding across our platform the moment scanners detect it, around the clock, in minutes, not weeks. It separates the false alarms from the real risks, and routes real ones straight to the team that owns the fix, with the evidence attached. But here's the part we care most about, because it's where most "AI security" stories go wrong: our AI can only take actions from a list that have been written, vetted, and reviewed by our security engineers in advance. Almost all the vulnerability fixes fall into standard changes, and most of those are low-risk changes that have been done by a human thousands of times before without an issue. We call that class of changes “standard pre-approved AI changes”. If the issue the AI detected can be fixed by the standard pre-approved changes, the AI broker will be able to apply the change autonomously and immediately. That allows us to go from detecting a vulnerability to fixing the vulnerability in minutes, before hackers attempt to exploit it. 

Every decision, machine or human, lands in a permanent, unchangeable audit record. We continuously measure the AI's accuracy against human corrections, and if it drifts, that's a signal to stop and retune, not shrug. In other words: machines apply the standards at machine speed; humans own what the standards are. That's the loop, and humans hold the part of it that requires judgment, accountability, and trust.