AI vulnerability scanning is becoming a baseline security practice

At a glance

What this is: This is an independent analysis of reported CISA use of Anthropic’s Mythos to scan federal code repositories, with the key finding that AI-assisted vulnerability discovery is becoming operationally normal.

Why it matters: It matters because faster code scanning changes how IAM, PAM, and NHI teams think about secrets exposure, repository access, and privileged remediation workflows in modern software and AI-assisted operations.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read Swarmnetics' analysis of CISA's use of Mythos for vulnerability scanning

Context

AI-assisted vulnerability scanning is no longer a theoretical capability. The article reports that CISA is using Anthropic’s Mythos to scan code repositories, uncover a large number of vulnerabilities, and accelerate defensive review at a pace that manual security testing often cannot match. For identity teams, the significance sits in the repository-to-runtime path, where exposed secrets, weak service account handling, and overly broad access can turn code issues into identity issues quickly.

This is not only about code quality. When AI tools are used to find weaknesses before attackers do, organisations need to reassess how quickly they can identify credential exposure, rotate secrets, and validate whether non-human identities tied to software pipelines still have the access they need. The starting position described in the article is increasingly typical of modern security operations, not an edge case.

Key questions

Q: What breaks when AI scanners find secrets but no one owns the credentials?

A: Discovery without ownership leaves organisations with a list of exposed secrets but no reliable way to revoke, rotate, or trace them. The usual result is delayed remediation, duplicated effort, and stale credentials that remain usable long after the issue is known. Effective response requires a mapped owner, a retirement path, and a clear control for every credential class.

Q: Why do repository scans quickly become an NHI governance issue?

A: Because code repositories often contain the credentials and trust relationships that non-human identities depend on. Once a scanner finds those artefacts, the relevant questions shift to who owns the identity, where it is used, whether it has standing privilege, and how fast it can be revoked or rotated. That is an IAM and NHI problem, not only an AppSec problem.

Q: How do security teams know whether vulnerability assessment is actually working?

A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action. A working programme reduces uncertainty around what to fix first. If the same issues keep reappearing or the queue is dominated by false alarms, the tool is not helping governance.

Q: Who is accountable when AI-assisted scanning exposes a shared service account?

A: Accountability should sit with the repository owner, the service owner, and the security function that governs the credential lifecycle. Shared credentials fail when responsibility is unclear, so organisations need a pre-agreed owner for rotation, replacement, and decommissioning. Governance should make it impossible for exposed secrets to sit in a shared no-man’s-land.

Technical breakdown

AI-assisted code scanning and the vulnerability discovery loop

AI-assisted scanning uses a model to inspect source code, configuration, and repository metadata for likely weaknesses such as insecure patterns, exposed credentials, hardcoded tokens, and unsafe access logic. The value is not that the model replaces vulnerability research, but that it compresses the discovery loop and surfaces candidates faster than manual review can. In practice, this changes how security teams stage triage, because the bottleneck moves from finding issues to confirming, prioritising, and fixing them across many repositories at once.

Practical implication: establish a triage workflow that can validate and route AI-discovered findings into patching, secrets rotation, and access review without delay.

Why code scanning often becomes identity scanning

Code repositories frequently contain identity material. Service account names, API keys, deployment tokens, CI/CD credentials, and federated trust settings are often embedded in code, config files, or build pipelines. That means a vulnerability scan can uncover not just software flaws but the access paths that underpin non-human identity governance. Once those credentials are identified, the real security question becomes whether the associated identity has standing privilege, where it is used, and how quickly it can be revoked or rotated.

Practical implication: link repository scanning to secrets inventory, NHI ownership, and revocation workflows so findings do not stop at the code layer.

Automated patching only works when identity controls are already instrumented

The article’s broader claim is about preemptive scanning and future automated patching. That only works if identity and access controls are already observable enough to support safe remediation. If service accounts are opaque, secrets live outside managed vaults, or access reviews lag behind actual deployment state, automation can surface problems faster than the organisation can safely change them. The technical issue is therefore not only detection, but remediation readiness across identity, pipeline, and runtime boundaries.

Practical implication: measure whether your remediation process can rotate credentials and adjust access faster than your normal release and review cycle.

NHI Mgmt Group analysis

AI vulnerability scanning is becoming an identity governance problem, not just a security engineering task. The article describes repository scanning for weaknesses, but in practice the most consequential findings are often secrets, service accounts, and trust relationships. That means code review, IAM, PAM, and NHI governance are converging around the same evidence stream. Practitioners should treat AI-assisted scanning as a control input for identity governance, not as a standalone AppSec function.

Secret exposure remains the named concept that most directly links AI scanning to real-world compromise. A model that finds weak code is often surfacing the exact material attackers seek: tokens, keys, certificates, and deployment credentials. The governance failure is not only exposure, but delayed detection and delayed revocation. Organisations should connect scanner output to credential lifecycle controls and exploit-response workflows.

Automation will widen the gap between discovery and remediation unless ownership is explicit. If AI can find issues faster than teams can assign accountability, the organisation gains visibility without reducing risk. This is especially true for NHIs that sit inside pipelines and deployment tooling, where ownership is often fragmented. Security teams should map every scanned secret or privileged integration to a named owner and a revocation path.

Federal adoption signals a broader shift in how security work is being prioritised. Even where policy friction exists, the operational direction is toward continuous, preemptive discovery of software weakness. For IAM and NHI programmes, that means access reviews and secret rotation can no longer be periodic background tasks. They become part of the same continuous control loop as code scanning and incident response.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
• From our research: 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
• For practitioners: Use the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs to connect discovery findings to rotation, offboarding, and ownership controls.

What this signals

AI-assisted scanning will expose whether identity remediation is actually operational or only documented. If your team cannot revoke a secret or reissue a service account faster than the next deployment cycle, vulnerability discovery will outpace control execution. The practical test is whether a scanner finding turns into a closed identity event, not whether it creates another ticket.

Secret remediation latency is now a material control metric. In our research, 91.6% of secrets remain valid five days after notification, which shows how often discovery and revocation are separated in practice. That gap makes continuous scanning useful only when paired with lifecycle tooling and clear ownership. Practitioners should align this work with the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.

The next programme maturity question is whether AI finds risks before attackers do and whether the organisation can act before that window closes. If not, scanning becomes an intelligence feed rather than a control.

For practitioners

• Connect repository findings to secret revocation Route any discovered token, API key, or certificate from scanning into the same incident queue as code fixes, and require proof of revocation before closure. Use the same workflow to update the service account owner and deployment record.
• Map scan results to NHI ownership Maintain an inventory that ties every CI/CD credential, service account, and deployment token to a human owner, a system owner, and a retirement date. Without that mapping, automated scanning will find exposure but not tell you who can safely act.
• Shorten the credential remediation window Set a target to rotate or revoke exposed secrets before the next scheduled deployment cycle, then test that target with a live exercise. This is where the 91.6% valid-after-notification problem becomes operationally relevant.
• Review privileged repository access Audit who can read, clone, or administer repositories that contain build logic, deployment scripts, and infrastructure definitions. Align those permissions with least privilege and isolate repositories that contain sensitive operational material.

Key takeaways

• AI-assisted vulnerability scanning is most valuable when it surfaces secrets and trust relationships, because those findings bridge code security and identity governance.
• NHIMG research shows secrets often remain valid for days after exposure, which makes remediation latency the control variable that matters most.
• Security teams should connect repository findings to ownership, revocation, and lifecycle controls so discovery leads to actual risk reduction.

Key terms

• AI-Assisted Vulnerability Scanning: The use of an AI system to inspect code, configurations, or repositories for security weaknesses faster than conventional manual review. It improves discovery speed, but the control value depends on how well findings are triaged, validated, and turned into remediation actions.
• Secret Remediation: Secret remediation is the operational process of neutralising an exposed credential after discovery. It usually includes validation, owner assignment, revocation, rotation, and downstream access verification so that the secret can no longer be reused by an attacker or an unintended system.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials — ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.

What's in the full analysis

Swarmnetics' full article covers the operational detail this post intentionally leaves for the source:

• Anonymous-source reporting on how CISA is using Mythos in federal code repository scanning
• The specific security vulnerability patterns the model is uncovering across codebases
• Context on the policy reversal around Anthropic tools and the federal response to AI-assisted scanning
• Why public Fable access and preview tooling matter for wider defensive adoption

👉 Swarmnetics' full article covers the reported federal use case, vulnerability findings, and policy context in more detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and lifecycle controls. It helps practitioners connect discovery, ownership, and remediation across identity programmes.