# AI is finding software vulnerabilities faster. Is your SaaS company ready? Frontier models can now find serious flaws in heavily tested software. The useful response is not panic or another generic tool list—it is a faster loop for preventing, fixing and proving how your company manages security. AI is compressing vulnerability research from both sides. Google says Big Sleep found a critical SQLite flaw before attackers could use it, while Anthropic reports more than 500 validated high-severity findings from its defensive research.[1][2] Small SaaS teams should treat this as an operating change: reduce preventable exposure, shorten patch and incident cycles, keep current evidence, and prepare to answer the security reviews that increasingly gate enterprise purchases. ## AI can now search for vulnerabilities at machine scale Google says its [Big Sleep vulnerability-research agent [1]](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-our-big-sleep-agent-makes-big-leap) helped identify a critical SQLite vulnerability that threat actors knew about and intended to exploit. Google reported it for patching before the planned exploitation. That is a defensive success, but it also demonstrates that models can reason through unfamiliar software well enough to locate consequential flaws. [Anthropic's zero-day research [2]](https://www.anthropic.com/research/zero-days) describes the same change at larger scale. The company says Claude found high-severity vulnerabilities in codebases that had already received years of fuzzing and that its researchers had validated more than 500 high-severity findings. These are vendor-reported results, not evidence that every model can autonomously compromise arbitrary software, but they establish that AI-assisted vulnerability discovery is producing real findings. The [2026 Verizon Data Breach Investigations Report [3]](https://www.verizon.com/business/resources/reports/dbir/) frames generative AI as an accelerator across attack techniques, from spotting security gaps to producing malware. The important shift for a SaaS company is therefore speed: more actors can inspect more code, assemble convincing lures and adapt known techniques with less manual work. ## The real change is a compressed security cycle AI does not make every attack novel, autonomous or successful. Many compromises still depend on familiar weaknesses: exposed credentials, unpatched dependencies, excessive permissions, insecure defaults and incomplete monitoring. AI makes those weaknesses easier to search for and act on repeatedly. The old operating assumption was that a small product might have time between a flaw becoming knowable and someone targeting it. That margin is becoming less dependable. Defenders can use the same capabilities to review code and propose repairs, but only organizations with a working validation and deployment process can turn a model's finding into a safe production fix. Security therefore becomes a throughput problem. A team needs to discover relevant exposure, reject false positives, prioritize real impact, ship a tested repair and update its evidence before the next customer or attacker asks the same question. Buying an AI scanner without improving that loop merely creates a faster queue of alerts. ## AI does not replace the security basics [CISA's Secure by Design guidance [4]](https://www.cisa.gov/securebydesign) treats customer security as a product requirement rather than an optional technical feature. That principle becomes more valuable—not less—when vulnerability discovery accelerates. For a small SaaS team, the highest-value work is usually unglamorous. Inventory internet-facing services and critical dependencies. Require phishing-resistant multi-factor authentication for privileged access. Remove long-lived shared credentials. Keep production access narrow. Automate dependency checks and supported runtime updates. Test backups and incident escalation. Review AI-generated code with the same standards as human-written code. AI-assisted scanning can extend a small team, especially when it produces reproducible evidence and patches that can be tested. It should sit inside the development process rather than function as an oracle. A suspected vulnerability still needs validation; a proposed patch still needs code review, security tests and regression tests. - Prefer findings with a clear affected path, reproduction steps and an explanation of real-world impact. - Keep discovery and exploit validation away from production credentials and unrelated systems. - Patch the root cause and add a regression test instead of suppressing the individual alert. - Track the age of critical findings and supported dependencies, not the raw number of scanner messages. - Record who approved security-sensitive changes and which evidence supported the decision. ## Enterprise buyers will ask you to prove it The pressure is not limited to incident prevention. [CISA's Secure by Demand guide [5]](https://www.cisa.gov/resources-tools/resources/secure-demand-guide) gives software buyers questions for assessing whether a vendor systematically addresses security defects. Procurement teams use the same principle when they request policies, audit reports, penetration-test summaries, architecture details and completed security questionnaires. A strong product can still lose momentum when the company cannot explain how it protects customer data. The answers often live across engineering, legal, operations and old spreadsheets. That creates two risks: a slow response that stalls the deal, and an inconsistent response that promises a control the product does not actually have. This is why security documentation is part of the operating system, not paperwork added after the product is secure. Current policies give teams an agreed description of access control, encryption, incident response, backups, data retention and supplier management. Evidence then shows whether those policies are followed. ## Certifications and questionnaires answer different questions SOC 2 and ISO 27001 assessments can give buyers independent evidence about a company's controls or management system. They do not eliminate every product-specific concern, and a logo does not answer how a particular feature stores data, which subprocessors it uses or how an incident would be handled. A security questionnaire is the buyer's structured due-diligence process. It may reuse common frameworks, but it usually asks about the vendor's actual architecture, policies and operational practices. Companies do not complete these questionnaires in order to become certified. Instead, audit reports, policies and control evidence become sources for answering them. The useful goal is consistency between the product, the policy, the audit evidence and the answer sent to the customer. AI can draft from that material, but it should not invent a mature control because the question sounds as if the buyer expects one. A precise ‘no, with this compensating control and roadmap’ is safer than a confident fiction. ## A practical AI-era security toolkit Tools should map to a bottleneck in the operating loop. A five-person company does not need an enterprise platform in every category, but it does need clear ownership for each job. - Code and application security: [Semgrep](https://semgrep.dev/products/semgrep-code/) combines static analysis with AI-assisted review, while [GitHub Dependabot](https://github.com/features/security/software-supply-chain) can identify vulnerable dependencies and raise security-update pull requests. Judge either by validated findings and accepted fixes, not alert volume. - Secrets and identity: [1Password Secrets Automation](https://developer.1password.com/docs/secrets-automation) and [Doppler](https://doppler.com/platform/secrets-manager) provide centralized ways to manage application and infrastructure secrets. Pair that with phishing-resistant MFA, short-lived credentials where possible and separate access by environment. - Monitoring and response: [Sentry](https://docs.sentry.io/) connects application errors, traces and logs so developers can investigate production failures with context. It does not replace security monitoring: define high-impact alerts, incident ownership and tested backup recovery separately. - Compliance evidence: [Vanta](https://www.vanta.com/products/automated-compliance) automates evidence collection and continuous control monitoring across frameworks such as SOC 2 and ISO 27001. Start with a lightweight policy and evidence workflow; add a broader platform when audit scope and control volume justify it. - Customer assurance: when repeated reviews start pulling founders and engineers into spreadsheets, [security questionnaire automation software](https://responsehub.ai/) such as ResponseHub can draft answers from policies and previous responses. ResponseHub says it supplies exact source citations and a confidence score so a person can verify each answer before sending it.[6] ## A 30-day plan for a small SaaS team - Week 1 — map the attack surface: list public services, repositories, cloud accounts, critical vendors, data stores and privileged identities. Assign an owner to each. - Week 1 — close obvious gaps: enforce MFA, remove dormant access, rotate shared credentials, protect branches and confirm that supported runtime and dependency updates are reaching production. - Week 2 — make findings actionable: run existing scanners, validate the highest-impact paths and create one patch SLA based on exposure and severity. - Week 2 — test recovery: restore one backup, rehearse one credential compromise and record the evidence needed to investigate it. - Week 3 — document reality: write or update access control, incident response, data handling, backup and supplier policies. Link statements to owners and evidence. - Week 4 — rehearse customer due diligence: complete one representative security questionnaire from the current evidence, identify unanswered questions and fix the underlying process before automating it. - At day 30 — measure cycle time: how long did it take to validate, repair, deploy and document the most serious finding? Improve that loop before adding another dashboard. ## Frequently asked questions - Is AI already finding real zero-day vulnerabilities? Yes. Google and Anthropic have published examples and defensive research results, although their claims describe controlled programs with expert validation rather than universal autonomous hacking.[1][2] - Does AI mean every SaaS company needs a large security team? No. It means small teams need explicit ownership, secure defaults, faster patching and less dependence on undocumented knowledge. - Do we need SOC 2 before selling to enterprise customers? Not always. Requirements vary by buyer, industry, data and deal risk. Buyers may request policies and a questionnaire before, alongside or instead of a certification. - What is the difference between a certification and a security questionnaire? A certification or audit gives standardized third-party evidence. A questionnaire asks the vendor to explain controls and product-specific practices for one buyer's review. - Can AI answer a security questionnaire for us? It can draft and retrieve relevant material, but a responsible owner should verify every consequential claim against current policies and evidence. - Which security tool should a small SaaS company buy first? Start with the bottleneck that creates the greatest exposure. Identity, secrets, dependency updates and backups often matter before a broad compliance platform. ## Sources - [[1] Google Cloud: Big Sleep vulnerability discovery](https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-our-big-sleep-agent-makes-big-leap) - [[2] Anthropic: evaluating LLM-discovered zero-days](https://www.anthropic.com/research/zero-days) - [[3] Verizon: 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) - [[4] CISA: Secure by Design](https://www.cisa.gov/securebydesign) - [[5] CISA: Secure by Demand guide](https://www.cisa.gov/resources-tools/resources/secure-demand-guide) - [[6] ResponseHub: security questionnaire automation](https://responsehub.ai/)