Managing Agentic Security at Scale

On the code we scan at depth, the volume of findings is now the constraint: frontier models plus an agentic harness surface more real, exploitable findings than engineering can absorb. We can find vulnerabilities faster than engineering teams have historically been able to act on them. The harder question now lives downstream: when a pipeline returns far more findings than a team can process, which ones deserve engineering attention, and on what timeline? Across the industry, AI has accelerated vulnerability discovery faster than the rest of the lifecycle has evolved. Validation still depends on environment access, credentials, and expert judgment, and remediation follows the review and release processes that keep production stable. The result is a lifecycle running at two speeds: machine-speed discovery and human-speed remediation. Closing that gap starts with deciding which findings deserve attention, and how to group them. This is the question we’re working through at Salesforce. The leverage came from how we organize what happens after a finding leaves the pipeline. We built it around two approaches. Today’s vulnerability remediation runs at two speeds:…