Vicarius launches ScriptAI for faster vulnerability fixes

Vicarius has launched ScriptAI, a generative AI engine built into its vRx platform. The tool generates and validates detection and remediation scripts in under an hour.

The launch adds an automated workflow to the company's vulnerability remediation offering as security teams face a growing volume of software weaknesses and patch delays.

ScriptAI is designed to create detection and remediation scripts when an official patch is delayed, unavailable, or considered too risky to deploy. The process starts with AI identifying an exposure. ScriptAI then develops a remediation script, Vicarius' research team reviews the logic, and the vRx platform executes and verifies the fix.

Generated scripts are not sent directly into customer environments. They are reviewed by humans before being added to the vScript library and deployed, a step intended to reduce the risk of disruption in production systems.

Vicarius is positioning the product as a response to a widening gap between how quickly vulnerabilities can be found and how slowly they are often fixed. It pointed to advances in AI-based software analysis that have increased the speed and scale of vulnerability discovery.

"AI is changing the economics of vulnerability discovery. Models can analyze code, find weaknesses and develop exploits at a speed no human research team can match," said Roi Cohen, Chief Executive Officer, Vicarius.

He said that trend is increasing pressure on remediation teams.

"But finding ten times more vulnerabilities is meaningless if remediation still happens through tickets, manual research and weeks of engineering work. We believe the next step is obvious: if AI can find the vulnerability, AI should help build the protection. ScriptAI brings that capability directly into the remediation workflow," said Cohen.

Validation process

Vicarius said its validation model rests on three principles. First, pass-fail judgments are made by a deterministic judge rather than a language model. Second, each validated case includes a cryptographically signed evidence manifest that customers can verify independently. Third, each generated script follows a fixed operational sequence of precheck, apply, verify, and rollback.

That sequence is intended to stop a script from progressing if it disrupts a service. The scripts run natively as operating system-level Bash and PowerShell, without requiring additional agents, SIEM dependencies, or proprietary rule formats.

The new tool sits within Vicarius' broader "True Remediation" framework, which offers several ways for customers to respond to vulnerabilities. These include deploying an available patch through vPatch, using patchless protection through vShield, running remediation through vScript, and generating new detection and remediation logic through ScriptAI when an existing option is unavailable.

Backlog pressure

Vicarius argues that vulnerability management can no longer rely on patching alone. In many environments, patches may not yet exist, may arrive too late, or may create operational risks that force security and IT teams to seek alternatives.

That has created a market opening for suppliers offering compensating controls, temporary fixes, and workflow tools aimed at shrinking the period between discovery and response. ScriptAI targets that gap by combining AI-generated scripting with a human review stage before deployment.

The product is available immediately within the vRx platform. Vicarius is positioning the approach as a way to turn remediation into a faster operational process rather than allowing newly discovered vulnerabilities to build up in manual queues.

Scripts generated by ScriptAI enter the platform's vScript library only after human verification and validation, creating what Vicarius described as a step between AI generation and production deployment.