“CISOs should demand a Safety Relevance Layer in their risk modeling, a structured framework that requires every AI-generated finding to pass automated verification, including dynamic proof-of-concept validation and strong false-positive filtering, before it reaches a human analyst,” Datta mentioned.
Those controls also needs to cowl disclosure, significantly when AI instruments establish flaws in third-party open-source parts that the enterprise doesn’t management, Datta mentioned. Organizations want predefined escalation paths, notification timelines, and position assignments that take impact as soon as a confirmed problem is present in an exterior dependency.
“Ad hoc disclosure in an AI-accelerated environment isn’t just a process gap; it’s a liability,” Datta mentioned. “Trusting AI in the production pipeline requires verifiable auditability: organizations must be able to trace why the AI flagged a line of code, how it validated the exploit, and how it determined that the patch would not break downstream production systems.”
