Ivanti Taps Frontier LLMs to Automate Vulnerability Remediation: Inside the Push

Ivanti is betting that frontier large language models can take the drudgery out of one of cybersecurity's most persistent challenges: patching known vulnerabilities at scale. Chief Security Officer Daniel Spicer told Dark Reading that early experiments with LLMs have produced surprisingly strong results during initial triage and remediation workflows, suggesting AI assistants could meaningfully compress the time between vulnerability disclosure and patch deployment across enterprise environments. The initiative comes as Ivanti itself remains a frequent target for nation-state actors exploiting edge-device vulnerabilities, giving the vendor direct motivation to streamline its own defensive posture.

Despite the early promise, Spicer flagged two unresolved hurdles: cost and human-in-the-loop viability. Running frontier models against large fleets of endpoints, applications, and network assets can produce significant inference bills, particularly when remediation decisions require multi-step reasoning over code, configuration data, and CVE context. Equally important is whether security teams can maintain meaningful oversight when models propose patches or configuration changes autonomously. Ivanti's current approach keeps humans firmly in the approval chain, but Spicer acknowledged that scaling that model across thousands of tickets per week remains an open operational question.

The broader implication for security teams is that AI-assisted vulnerability management is moving from research demos into production roadmaps faster than many practitioners anticipated. Organizations evaluating similar tooling should start by hardening the fundamentals exposed during automated remediation cycles, including validating TLS configurations with an SSL/TLS checker, auditing public-facing services with a port scanner, and confirming asset ownership records via a WHOIS lookup. As LLMs become more deeply embedded in patch pipelines, the differentiator will not be the model itself, but the quality of the telemetry, identity controls, and human review processes wrapped around it.