Forescout Used Off-the-Shelf AI to Cut a Nine-Month Bug Hunt to 90 Hours

Forescout’s Vedere Labs aimed an AI harness built on Claude models at 10 networking stacks, seven it had combed by hand in 2020-21, and confirmed 99 flaws in about 90 hours.

Forescout says the same workflow is open to attackers and defenders alike, at a fraction of the old cost. The networking software involved, Transmission Control Protocol/Internet Protocol (TCP/IP) stacks, sits inside industrial, medical and network equipment that can stay in service for decades, and patches for it travel through several vendors before they reach a device.

What did the run cost?

The $935 paid for the automated analysis only, Forescout said in its report. That stage took about 10 hours and screened 362 candidate findings at an average of $2.58 each. Roughly 80 hours of dynamic validation followed.

Forescout estimates its total model spending at $1,200 to $2,300 and calls that likely 100 times less than a senior researcher’s manual work on the same stacks. The comparison leaves out the work of building the harness, which Forescout did not price. Binary firmware, where no source code exists, cost about six times as much to analyze and took twice as long.

What did it find?

Of the 99 confirmed flaws, 33 were known and 66 were new. Some 52% of the new ones rate high or critical, and Forescout has reported 54 to vendors and maintainers. The harness also rediscovered 40% of the flaws Forescout had disclosed on those stacks in its earlier Project Memoria research.

“AI did not eliminate the need for expert vulnerability researchers, but it dramatically compressed the work,” said Daniel dos Santos, Forescout’s vice president of research.

Why does patching lag?

The same stack code runs in products from many makers, so one flaw can reach hundreds of products from dozens of vendors, Forescout said, based on its earlier disclosures. A fix has to pass from the software developer through firmware and product vendors before it reaches the device, and for discontinued products it may never arrive.

CEO Barry Mainz said asset owners still run legacy systems that cannot easily be patched or taken offline, and that “containing risk, rather than patching, must be the priority.” Forescout sells network segmentation and isolation tools.

Which devices in the company’s own plants and hospitals run these stacks, and what keeps each one from being reached if no patch comes?