Vulnerability discovery: TrendAI puts agentic AI on the source code
TrendAI, the enterprise business unit of Trend Micro, has announced the private preview of TrendAI Vision One Autonomous Vulnerability Discovery. An agentic engine codenamed AESIR powers the service, which the company says identifies, validates and verifies fixes for vulnerabilities — including zero-days — in customer source code. It is a multi-model architecture built primarily on Anthropic models, pairs AI discovery with validation from TrendAI’s Zero Day Initiative (ZDI), and runs on Amazon Bedrock so that source code stays inside the customer’s own AWS environment.
“The service pairs AI built for accuracy with two decades of ZDI research,” said Sharda Tickoo, TrendAI’s country manager for India and SAARC, “helping customers fix what matters before attackers find it.” The framing matters. Vulnerability discovery has become a race: code ships faster than reviewers can read it, and AI tools now help attackers find flaws at machine speed. A service that points the same technology at a company’s own codebase is the defensive mirror of that race — and its value depends less on finding any flaw than on finding the ones that matter, quickly enough to patch them. That is the promise of agentic vulnerability discovery.
How it works
The workflow is deliberately supervised. It begins with a scoping interview; a ZDI expert then defines and tunes a custom scan, which the service team monitors and controls rather than handing the customer an unsupervised black box. The scan runs against the customer’s source code and produces a vulnerability report with a severity rating, an estimated CVSS score and a detailed write-up for each finding, cross-checked against ZDI research. After the customer builds and deploys a patch, the scan runs again to verify the fix — once more against ZDI research — before issuing a final verified patch status. Customers keep their existing Git repositories and code registries as the system of record.
Two design choices stand out. Running on Bedrock, in the customer’s AWS environment, addresses the objection that source code — the most sensitive asset a software company holds — should not leave its perimeter. And the human-in-the-loop scanning model, with ZDI researchers tuning and supervising, is a candid acknowledgement that fully autonomous vulnerability discovery is not yet trustworthy enough to run unattended.
The supervised model is worth reading closely. ZDI researchers tune the scan and the service team monitors it, which means a human decides what to look for and a human signs off on the result. That is a meaningful limitation dressed as a feature: it makes the service more accurate and more expensive to run, and it is why the offering looks less like a self-serve tool than a managed engagement.
The company behind it
TrendAI is a recent identity. Trend Micro renamed its enterprise cybersecurity business TrendAI in March 2026, keeping the parent company’s legal structure while presenting its enterprise platform, TrendAI Vision One, under the new brand. The company says it has 6,000 experts across 75 countries and that analyst firms including Gartner, IDC and Forrester recognise Vision One.
The more relevant asset is ZDI, which TrendAI describes as the world’s largest vendor-agnostic vulnerability disclosure program. Established in 2005, it works with more than 19,000 independent researchers and 450 dedicated researchers across 14 threat centres, and says it disclosed more verified vulnerabilities in 2024 than all other participating programs combined — about 73% of global disclosures. Its Pwn2Own contests have run for nearly two decades; at Pwn2Own Berlin 2026, participants demonstrated 47 zero-days for roughly $1.3 million in payouts.
That research pipeline is the part of the offering a rival AI vendor cannot easily replicate. It is the strategic point. Any vendor can call a frontier model and ask it to read code; few can check the model’s findings against two decades of coordinated disclosure. If ZDI’s research genuinely improves accuracy — fewer false positives, better severity calls — it is the kind of advantage that survives the next model release.
Testing the benchmark claim
The release’s sharpest claim is that the engine “outperformed single-model and agentic system scores on the CyberGym Leaderboard.” CyberGym is a real benchmark, built at UC Berkeley on 1,507 real-world vulnerabilities from 188 open-source projects, mostly sourced from Google’s OSS-Fuzz. It is a demanding test: agents get a vulnerability description and unpatched code, and must produce a proof-of-concept that reproduces the flaw.
Two facts qualify the claim. First, the benchmark is hard. CyberGym’s published results show that even the best agent-and-model combinations succeed only about 20% of the time — the top combination reached 17.9%, and enabling extended reasoning pushed one model to 22.0%. “Outperforming the leaderboard,” then, describes a narrow band. Second, the leaderboard is self-reported and stochastic. Its documentation states that individual teams evaluate and submit results, that agent runs vary between evaluations, and that “modest score differences may not reflect meaningful capability gaps.” The release does not say what score AESIR submitted.
Vulnerability Discovery Benchmarks
There is a structural reason for caution beyond this vendor. Vulnerability discovery benchmarks are young, and their leaderboards reward whoever submits; the field has not yet settled on a standard way to compare agentic systems on real code. Until it does, a claim of outperformance is a data point, not a verdict — and for vulnerability discovery, where a missed flaw is a breach, the difference between a good score and a meaningful one is large.
None of that makes the claim false. It means the claim is the company’s own, on a young benchmark, and that a reader cannot yet tell how large the margin was or what it means. The release’s own wording is careful here — it says the engine outperformed scores on the leaderboard, not that it set a record. For a reader, the honest position is that the claim is plausible and unproven, which is the state of most early agentic-security claims. No one has published the independent benchmarking that would settle it.
Why now: AI on both sides
The timing reflects a shift the security industry is still absorbing. Code now gets written faster than it can be reviewed, and AI-assisted discovery is compressing the window between a product’s release and a working exploit. TrendAI’s own account of Pwn2Own Berlin 2026 makes the point: the contest hit capacity for the first time in its history, and the company split its AI category into four sub-categories — a sign that AI now sits at the centre of how researchers and adversaries find vulnerabilities.
Autonomous vulnerability discovery is the defensive answer: point agentic AI at your own code before someone else does. It is a logical move for a company that owns both a disclosure pipeline and an enterprise security platform, and it fits a wider pattern of AI finding real flaws — CyberGym’s own evaluations surfaced dozens of zero-days and incomplete patches during testing. The economics point the same way. If AI makes flaws cheaper to find, defenders face the same asymmetry attackers exploit: one missed vulnerability is a breach, while a thousand false positives are noise. That is why accuracy, not raw discovery, is the metric that matters in vulnerability discovery — and why a vendor leans on its validation pipeline rather than its model.
What to watch
For buyers, the useful questions are the ones the release leaves open: the score AESIR submitted to CyberGym and under what conditions, how the service handles false positives at scale, what it costs, and which customers have run it. For the market, the test is whether agentic discovery becomes a standard part of the secure-development pipeline or remains a premium service for the largest enterprises. And, for TrendAI, the bet is that its ZDI research pipeline — the genuinely hard-to-copy asset — converts an AI capability into a durable advantage, rather than a feature its rivals match within a year. For security leaders, the launch is also a reminder that the tooling race cuts both ways: the same agentic methods that help defenders find flaws help attackers too, and a service that only finds what it is pointing at does not change that balance on its own.
What the announcement does and doesn’t establish
It establishes a private-preview service, its architecture, its deployment model and its supervised workflow. It does not establish a leaderboard score, a price, a named customer or an independent evaluation. The “outperformed” claim is company-reported, on a benchmark whose own authors caution that small gaps may not reflect real capability differences, and whose top scores sit around 20%. The internal benchmarking behind the detection-accuracy claim is not published.
The honest summary is that a security vendor with a two-decade disclosure pipeline has pointed agentic AI at the most valuable target there is — its customers’ source code — and wrapped it in the human oversight the technology still needs. The mechanism is credible and the research asset is real; the headline benchmark claim is the part a reader should hold lightly until the numbers are there. For now, that is the state of vulnerability discovery at machine speed.