Can We Trust AI To Write Vulnerability Checks? Here's What We Found

According to Intruder, vulnerability management is a race where attackers move quickly, scans take time, and a slow or inaccurate scanner leaves organisations exposed. The piece describes how the security team tested AI for writing vulnerability checks, starting with a one-shot approach that produced messy outputs and invalid syntax, then shifting to an agentic approach using Cursor’s agent to improve results.

With a curated repo of Nuclei templates and clear prompts, the team saw a noticeable lift in the quality of templates, bringing outputs closer to what engineers would write manually, though not yet fully autonomous. They highlight successes such as creating checks for exposed admin panels and an unsecured Elasticsearch template that verifies data exposure beyond public detections.

However, challenges remain, including risk of false positives from weak matchers and issues with truncated curl outputs, necessitating human oversight and guardrails. The article, dated 29 September 2025, emphasises that AI should augment rather than replace expert security engineers, aiming for safe automation and high-quality custom checks rather than turnkey automation.