ArmourCode launches Zero to cut vulnerability backlogs

ArmourCode has launched ArmourCode Zero, an agent-based product designed to help security teams reduce vulnerability backlogs. The system focuses on fixes rather than raw findings.

Zero reads vulnerability findings, prepares an initial triage assessment, and groups issues by the change needed to resolve them. According to ArmourCode, this can cut the number of actions security teams need to process by combining multiple findings into a smaller set of fixes, such as a single dependency upgrade that clears several alerts.

In one customer example cited by ArmourCode, a tenant with about 28,600 findings was reduced to about 8,900 fixes. That amounted to 69% fewer items to work through, with fixes ranked by the amount of risk each one removed.

The product also connects to coding agents already used by engineering teams, including Claude Code, Codex, and Muse Code, and drafts code changes in a pull request for human review. A fix is counted only once the exact commit has been rescanned and the original finding no longer appears.

Backlog focus

The launch reflects a wider shift in cyber security as companies try to manage a growing volume of vulnerabilities while attackers use automation and AI tools to shorten the time between discovery and exploitation. ArmourCode argued that traditional approaches have focused too heavily on identifying issues rather than closing them.

Phil Venables, a Board Member at ArmourCode, framed the issue in stark terms in comments cited by the company. "We're clearly going to be in a race to respond at machine speed to machine speed attacks," Venables said.

ArmourCode said its platform processes more than 400 billion findings a year, more than 1 billion MCP and API calls, and more than 1 billion agentic actions through more than 100,000 agents deployed across its customer base. Zero sits on top of that platform and uses the company's Context Risk Graph, which links findings to assets, code, owners, services, and controls across an organisation.

That context is central to how the product prioritises work. ArmourCode gave the example of the same critical vulnerability carrying very different urgency depending on whether it sits on an isolated test server or an internet-facing payment service.

Autonomic model

ArmourCode ties the new product to a broader model of "autonomic" cyber defence, in which systems monitor, analyse, plan, and execute actions with human oversight. The company mapped Zero to a five-step loop covering the continuous intake of findings, triage and recommendation, grouping of fixes, drafting of remediation work, and the use of a shared knowledge base.

Under that model, human users still approve consequential actions. Users can edit, confirm, or undo each action card, while secrets are redacted before any model call and customers can use their own model keys.

ArmourCode presented that control structure as necessary to build trust in automated remediation. It said evidence gathered through rescanning is used to verify whether a fix has worked, and that false positives can also be documented with supporting evidence.

Zero is being opened first to a limited group of customers. ArmourCode said it wants to test the product with teams handling real vulnerability backlogs before expanding access more broadly.

The product marks the latest attempt by security software vendors to apply generative AI and workflow automation to vulnerability management, an area where large enterprises often face hundreds of thousands or even millions of open findings. Rather than adding another dashboard, ArmourCode is pitching Zero as a tool that turns findings into a smaller list of ranked remediation tasks and tracks progress through verified fixes.

"Trust in an autonomic system is earned one verified fix at a time," Venables said.