This is the third installment of our Cycode AI data series. The first two looked at how security teams talk to an agent. This one looks at what happens when automation and bulk actions complement prompt-based AI.
We closed our analysis of 500 Maestro conversations with a prediction. Prompt-based investigation would always have a place, but the biggest gains in agentic security would come from agents acting at scale and without being asked.
We have since launched two capabilities: bulk AI analysis and agentic workflows. Now, we can see if that hypothesis holds up.
For this analysis, we looked at another batch of Maestro conversations and 10,000 AI-driven exploitability analysis and remediation actions executed against real environments. These 10,000 actions were initiated in four different ways. Some came out of Maestro conversations. Some were invoked directly in the UI or through the API. Some ran as bulk analysis across an entire backlog. Some fired from a policy-triggered automation workflow.
Analyzing the actions by the activities conducted and how they were initiated illuminates a trend: users invoke agents in different ways for different use cases.
Where prompt-based AI dominates: complex tasks and exposure exploration
Exposure assessment continues to be a compelling practitioner use case for Cycode Maestro. A practitioner pasted a URL to a public writeup of a compromised npm package cluster, published hours earlier. The question was the one every security team asks at that moment: Are we affected?
Maestro read the advisory and extracted affected package-and-version pairs from it. Then it fanned out parallel queries across every repository in the environment. It returned a per-package presence table, and alongside it an explicit statement of what a null result does and does not prove. Maestro did not just answer. It qualified its answer with limitations and guidance. The pattern repeated across the conversation data with a compromised Rust crate and an npm campaign hosting adware.
While Maestro conversations initiated the fewest of the ten thousand by count, they were the most complex and involved the most agents per action by a wide margin. The corpus of conversations references over 375 distinct CVEs, with each instance following a similar sequence: a human arrives with an unstructured input and an urgent question, often for a brand new advisory. The conversation shapes the question into a clear and structured query.
Multi-turn sessions, parallel tool orchestration, and mid-investigation course corrections are exactly what you want when the path is unknown.
Conversation builds the strategy
Conversation is overwhelmingly orientation work. Am I exposed? Where is this in my environment? Does this threat apply to me? How do I structure this query?
The trend we observed next is fascinating: teams repeatedly turned those conversations into something permanent.
One team prompted Maestro to run a secrets audit across more than a hundred repositories. Partway in, the practitioner specified matching logic to refine the results based on organizational standards and patterns. Maestro executed the remainder of the audit under those constraints. That constraint is institutional knowledge. It lives in a senior engineer’s head and nowhere else, and the multi-turn audit not only surfaced it but encoded it into a policy.
Explicit query-building conversations show the same arc. Several teams converged independently on the same target: find external GitHub Actions pinned to anything other than a full commit SHA, scoped to a labeled organization. The threads move from “Can you find this?” to “Build this into a repeatable query.” Those CIG graph queries do not stay conversations. They get saved as persistent policy checks that run continuously afterward.
Teams are using the chat window to design policies and controls that form underlying security strategy. Workflows and bulk analysis are where controls and analysis run at scale.
Automation and bulk actions execute the strategy at scale
The overwhelming majority of AI actions were not initiated from Maestro conversations. That is not a Maestro shortfall. It is the system working correctly.
When strategies are well-formed, human-dependent prompts or conversations create friction that efficient risk management can’t afford. A high-risk CVE in a crown-jewel application is identified in an SCA scan. That doesn’t require exploration. That requires consistent and immediate action: triage whether it’s exploitable and fix it if it is.
Roughly a third of the ten thousand actions were exploitability analyses. Roughly two-thirds were AI remediations. The overwhelming majority of both were initiated without a conversation.
These are the workflows that scale. Our previous analyses showed consistent but linear growth in AI analysis. This was driven by a limit: every analysis started with a person deciding to run one. Volume grew because more people ran more of them. Capacity equaled attention.
In August, bulk analysis and policy-triggered agentic workflows went live. Within two months, agent-initiated runs accounted for roughly 45% of all exploitability volume. Monthly exploitability analysis grew nearly 10x from the first full month in the dataset, with agent-initiated analysis more than doubling month over month.
While AI remediation represents the majority of AI actions in the dataset, AI exploitability just eked out remediation in weekly task volume. Still, AI remediation remains steady, which is unsurprising as we’ve observed that organizations adopting AI remediation have a 17x higher 90-day close rate for critical vulnerabilities than those that have not widely adopted it.
Translating agentic security into value: Capacity that did not exist, and speed that was not possible
Ten thousand agent actions conservatively represent 5,000 hours of manual-equivalent effort, nearly two and half years of skilled security engineering work. That estimate is deliberately conservative. It assumes half an hour for a person to assess one CVE’s exploitability in application context, and half an hour to produce and validate a single fix. Most engineers would call both generous to the human.
| AI Action | Actions in Dataset | Manual Time Per Task Equivalent | ||
|---|---|---|---|---|
| Conservative | Moderate | Generous | ||
| Exploitability Analysis | 3,204 | 30 min | 45 min | 60 min |
| Remediation | 6,796 | 30 min | 45 min | 60 min |
| Total hours | 5,000 | 7,500 | 10,000 | |
| TOTAL FTE Years | 2.4 | 3.6 | 4.8 | |
But the hours are the less interesting half of this. Exploitability analysis is now agent-initiated, and that portion is not work that moved from a person to an agent. It is coverage nobody was doing because teams didn’t have the capacity or headcount to perform it.
Triage and remediation capacity do not scale with the size of the backlog or the speed of the threats. It never has. That was the real constraint, and it stayed tolerable as long as risk appetites accepted that most findings simply go unassessed.
AI, however, is changing the risk calculus.
Why the timing matters
We recently wrote about the impending “patchmageddon” as the gulf between the speed and volume of vulnerability exploitation and the capacity of remediation widens. Between AI-discovered vulnerabilities flooding teams with CVEs, shrinking time to exploit, and the ability for adversarial AI to link lower-severity vulnerabilities into high-risk attack chains, security teams need a strategy for frontier AI readiness.
Agentic security capabilities that help teams quickly encode the foundational security strategy and execute at scale are necessary for that readiness.
When a batch of high-severity disclosures lands, most of the work is known in advance: identify affected repositories, assess exploitability in context, prioritize by real risk, analyze upgrade impact, generate fixes. That requires orchestration and execution humans can’t handle.
The critical preparation is not simply turning automation on. It is having run the playbook to know how to investigate your exposure, create policies from advisories, and leverage policies in automation. So, when the wave arrives, the workflows execute your team’s judgment and respond to risk the instant it appears.
Agentic security is not one interface. It is the right actor at the right moment with the right interface, grounded in shared context, under policy the security team controls. Conversation builds the strategy. Bulk analysis and workflows run it at scale. Ten thousand actions in, we’re seeing security teams put the theory into practice.
Want to see what agentic exploitability analysis and remediation look like against your own findings? Request a demo.
