Dominic Jainy is an acclaimed IT professional who operates at the cutting edge of artificial intelligence, machine learning, and blockchain technology. With deep experience in securing complex digital environments, he has a unique perspective on how automated tools are reshaping the traditional boundaries of software development and vulnerability management. As major tech leaders like Microsoft pivot toward AI-driven security analysis to combat zero-day exploits, Dominic’s expertise helps bridge the gap between high-speed technological innovation and the practical realities of maintaining a secure codebase. This conversation explores the rise of multi-model agentic scanning, the growing skepticism surrounding fully automated systems, and the paradox of securing the very AI packages that are currently riddled with unpatched vulnerabilities.
How is the integration of multi-model agentic scanning tools into software development leading to a more proactive defense against zero-day exploits?
The implementation of the multi-model agentic scanning harness, or MDASH, represents a massive shift toward using cloud-scale infrastructure to identify patterns and prioritize risk across the entire Windows codebase. By using several model families to engage in a “debate” that validates potential vulnerabilities, Microsoft is able to automate the discovery process while a separate pipeline eliminates the remaining false positives. This rigorous automation naturally leads to a higher volume of security updates, which we saw start to increase following the company’s July 9 announcement. While a surge in updates might seem overwhelming for IT teams, it serves as tangible evidence that defenders are finally shrinking the attack window for zero-day exploits. The focus is to create a more resilient engineering system that can handle discovery at a scale that human reviewers simply cannot reach alone, providing much more actionable guidance for the end customer.
Why do you think there is such a sharp decline in the number of organizations willing to rely entirely on AI for their vulnerability scanning despite the push from agencies like CISA?
There is a fascinating tension right now because while agencies like CISA are reportedly leaning into tools like Anthropic Fable to scan government systems, we are seeing a sharp plunge in confidence within the private sector. A Cobalt study recently highlighted that the percentage of organizations relying entirely on AI automation for their scanning needs dropped from 29% down to just 9% between 2025 and 2026. This skepticism is rooted in the reality that 78% of respondents found that these fully automated tools were missing critical vulnerabilities that required a human eye to detect. It is a sobering reminder that while AI is great for speed and scale, it still lacks the nuanced intuition of a seasoned security professional. Consequently, many organizations are at pains to maintain human oversight to ensure that the quality of updates remains high and that critical gaps don’t slip through the cracks.
Given the findings that a staggering number of AI packages are currently vulnerable, how do we address the risk of the tools themselves being the weak point in the security chain?
This is perhaps the most pressing irony in the industry today; we are racing to use AI to fix our code while the AI infrastructure itself is effectively on fire. An Orca Security study published on July 9 pointed out that 81% of organizations are currently running vulnerable AI packages, which creates a massive new surface for sophisticated attackers to exploit. Even more concerning is the fact that 99.9% of these fixable AI vulnerabilities remain completely unpatched, suggesting a dangerous level of complacency regarding the security of the tools themselves. We cannot simply update our Secure Development Lifecycle to account for AI-enabled attack techniques if we aren’t also securing the very libraries and packages that power our scanners. It requires a fundamental shift in how we prioritize patches, ensuring that the AI components are treated with the same level of urgency as any other critical binary in the system.
What is your forecast for the future of AI-powered vulnerability management over the next few years?
I believe we are heading toward an era of “validated automation” where the multi-model debate systems we see in MDASH become the industry standard for pre-screening, but human expertise remains the final gatekeeper for any high-confidence findings. The industry is currently undergoing a necessary correction, moving away from the “set it and forget it” mentality that led to that 99.9% unpatched rate for AI packages and toward a more disciplined, hybrid approach. I predict that as frontier AI companies are pushed to play a larger role in disclosures, we will see the “attack window” for zero-day exploits shrink dramatically because the speed of AI discovery will be paired with more efficient, automated deployment systems. Ultimately, the winners will be the organizations that can manage the higher frequency of updates without losing the human-in-the-loop oversight that prevents critical errors. The goal is a future where the defender’s AI is always one step ahead of the attacker’s exploit.