Security · SSDLC · a working concept

SSDLC when exploits are cheap

Shipping software when new CVEs arrive faster than fixes,
and an LLM can turn a CVE description into an exploit.

Samarthya · read the full post · press Esc for the overview

The map

Everything on one page

Why now

Three clocks changed

Volume

48,185
CVEs published in 2025, +20.6% on 2024. About 132 a day.

Exploit

28.96%
of newly exploited CVEs were attacked on or before publication day (23.6% in 2024).

AI

87%
of 15 one-day CVEs exploited by a 91-line LLM agent given the CVE text; 7% without it.

Defenders get the same tools: at DARPA's AIxCC final, automated systems found 86% of planted bugs and patched 68%, about 45 minutes per patch.

Sources: Jerry Gamblin 2025 CVE review · VulnCheck State of Exploitation 2026 · Fang et al., arXiv:2404.08144 · DARPA AIxCC results

The old way

"SDLC plus a scan at the end" fails

Too late

A finding at release competes with a deadline. The deadline usually wins.

A snapshot

Clean on Tuesday, vulnerable on Wednesday: a dependency got a CVE. Your code did not change.

A report

A PDF of 400 findings is a to-do list nobody owns.

The shift

From a gate to a rhythm

Classic SDLCSSDLC
WhenGate before releaseEvery commit, merge, night, and in production
OutputReportPR or ticket with an owner and a due date
PriorityCVSS severityExploited? Reachable? Likely? (KEV, exposure, EPSS)
Trivial fixesA developer, eventuallyA bot opens the PR; a developer reviews
Shipped softwareDoneRescanned daily against new CVEs
Standards

They say what, not how fast

  • NIST SSDF 1.1: Prepare, Protect, Produce, Respond (1.2 still a draft)
  • OWASP SAMM 2.0: five business functions, measurable maturity
  • SLSA 1.2: signed provenance from a hardened build

CISA BOD 26-04 (June 2026)

Four questions: exposed? in KEV? automatable? total control?
Worst combination: 3 days

At one large agency: 1% of instances were 3-day; 60%+ could wait for the next upgrade.

Risk-based triage: fix a small set very fast, and stop pretending the rest is urgent.

The loop

Every stage has a trigger and a timebox

blocks only new criticals and secrets  ·  stage 4 is where most new risk appears

Feed · check · vector

What each level is fed, and what it guards

Vectors: OWASP Top 10:2025 (A0x) and MITRE ATT&CK (T1xxx). Not here on purpose: broken access control (A01) and insecure design (A06) need threat modelling and people.

Triage

What triggers which timebox

My heuristic, loosely modelled on CISA BOD 26-04. The EPSS cut-off is a starting guess, to be tuned on your own data.

The values

Days to fix, by tier

T0 KEV + exposed: 3 days

T1 KEV, or exposed + likely: 14 days

T2 likely, or exposed: 30 days

T3 none of these: next upgrade

Same data, different place: Log4Shell is T0 on an internet-facing service and T1 on an internal one.

Open-source toolchain

One job, one tool, one format out

JobToolLicenceStage
SecretsGitleaksMITCommit, PR
SASTSemgrep CELGPL-2.1PR, merge
SCAOSV-ScannerApache-2.0PR, merge
Containers, IaC, SBOMTrivyApache-2.0Merge
DASTZAP baselineApache-2.0Nightly
SBOM monitoringDependency-TrackApache-2.0Nightly
Findings storeDefectDojoBSD-3-ClauseTriage

Everything writes SARIF or a CycloneDX SBOM, so it can land in one place.

The common data lake

Scanners know the bug. You know the context.

LLM in the loop

Bots propose, tests prove, humans merge

Trivial

Patch or minor bumps with upgrade guidance, lint autofix, base-image refresh.
Bot PR → human merges after CI.

Assisted

Parameterise a query, add output encoding, tighten config.
LLM draft PR + test → code owner.

Human

Authentication, authorisation, crypto, data model, major upgrades.
Developer, LLM as a pair.

  • No bot writes to main. Branch protection applies to bots too.
  • A finding closes when the rescan agrees, not when the PR merges.
  • Pick the model by the data: local open-weight for sensitive code, hosted where allowed.

Pattern from Google DeepMind's CodeMender: validate first, then "all patches … are reviewed by human researchers".

People

Still delivering, and teaching it

Deliver

  • A standing share of every sprint for the security queue
  • Measure flow: time to fix per tier, bot PRs merged in a week, oldest T0/T1
  • A missed T0 gets a blameless review

Teach

  • Show a real CVE becoming an exploit, in a sandbox
  • Teach triage, not fear: KEV, EPSS, exposure
  • One security champion per team
  • Make the secure path the default path
  • Share near misses
Fall. Get up. Build again.

Still open, and what to keep

Still unsure

  • How much to trust an LLM fix with only unit tests behind it
  • Reachability analysis that works across languages
  • Whether EPSS 0.10 is the right cut-off

Keep

  • Security in every stage, plus nightly rescans of shipped software
  • Timebox by risk: exploited + exposed gets days
  • One store; triage policy as code
  • Bots and LLMs write; humans merge

Full post, sources and the triage.py script: samarthya.me/posts/ssdlc-in-the-age-of-ai-exploits