From Alert Fatigue to Autonomous Triage: How Agentic AI Is Reshaping Vulnerability Management

Security teams are drowning in findings. SAST, SCA and secret-scanning tools generate thousands of alerts, most of them false positives or unreachable code, and analysts spend more time sorting noise than fixing real risk. This session shows how agentic AI can change that. Drawing on a working system I designed and built, I will walk through how an AI triage pipeline combines retrieval over CWE, MITRE ATT&CK and CISA KEV knowledge, code reachability analysis and exploit-probability scoring to classify findings, explain its reasoning and route confirmed issues straight to developers as fix pull requests, with a human analyst kept in the loop for every decision. Attendees will leave with a practical architecture, the guardrails that make AI triage trustworthy, and an honest view of where it works and where it still needs people.