Enterprise AI creates value when it improves how work gets done. In cybersecurity, that means helping teams turn vulnerability findings into decisions and corrections they can review, implement, and verify. The harder problem is rarely spotting the vulnerability, it’s acting on it: prioritizing what matters against real business risk, closing the gap quickly, and proving the fix held. Doing that reliably takes more than a capable model; it takes enterprise context and the platform to operationalize it.

Infosys Topaz brings together AI-first services, solutions, and platforms using generative AI. The Infosys–OpenAI collaboration extends this enterprise focus by combining OpenAI technology with Infosys Topaz Fabric, its composable, open agentic services suite.  For security leaders, this creates an opportunity to explore how AI-assisted investigation and engineering can fit into existing security practices. An Infosys Topaz-led approach would start with the business problem, connect the relevant capabilities to the client’s workflow, and evaluate whether they improve decisions before expanding adoption.

Why security findings need further investigation

Identifying a possible vulnerability starts a chain of work. Teams must determine whether it affects their software, examine supporting evidence, identify the responsible engineering team, and establish a safe correction.  A finding may lack sufficient application context. A proposed patch may need additional testing. A completed review may leave questions unresolved. These are different situations, and each requires a different decision.  The enterprise challenge is therefore broader than detection. More alerts or generated patches do not, by themselves, demonstrate progress. A useful security workflow must connect findings to ownership, review, testing, and a clear record of what remains unresolved.

How Infosys Topaz and OpenAI work together

The Infosys–OpenAI collaboration focuses on practical, responsible enterprise deployment, with an early emphasis on software engineering, modernization, and DevOps. Its announced applications include code review automation and vulnerability detection.  That engineering focus is relevant to security teams: detecting a possible issue is useful only when it leads to a decision about what to review and fix. OpenAI Daybreak brings together frontier models, codex security, responsible access, and the security harness. Its documented workflows include repository investigation, vulnerability-backlog triage, pull-request security review, and assistance with focused fixes.  An Infosys Topaz-led assessment would connect these capabilities to the client’s application context, engineering practices, and governance requirements. The approach would establish where AI assistance belongs, what reviewers must verify, and how its contribution should be measured.  The following three use cases illustrate this assessment approach, not completed client deployments.

Make vulnerability backlogs actionable

Consider a financial institution reviewing a backlog of scanner findings. Reviewers need to determine whether a reported issue applies to the current code, whether existing controls address it, and what evidence developers need before accepting a ticket.  Codex Security can investigate scanner results, dependency alerts, advisories, and tickets against repository context. It examines claims and relevant code paths, checks existing controls, and explains whether the evidence supports action, suggests the issue is not applicable, or requires further review. These complements established scanners.  An Infosys Topaz assessment would begin with one approved application and a representative backlog. Security and engineering teams would agree on the evidence needed to accept, reject, or escalate a finding.  The evaluation would compare decision time, reviewer acceptance, and unresolved evidence gaps with the existing process. Processing more findings would matter only if the resulting decisions became more useful.

Bring security decisions closer to code changes

A change to an account-management service can raise an important release question: which security assumptions changed, and does the available evidence address the concern?  Codex Security Review analyzes GitHub pull-request changes alongside repository context and configured threat models or security guidance. Its reports include supporting evidence, attack paths, validation details, and remediation guidance.  Infosys’s application security and DevSecOps services include designing, deploying, operating, and sustaining security gates across the software development lifecycle. This provides relevant experience for assessing where an additional AI-assisted review would fit.  An Infosys Topaz-led evaluation would start with one repository, named reviewers, and explicit handling of incomplete results. Success would depend on the usefulness of the evidence and the additional review effort. Release authority would remain with the customer.

Turn remediation into an evidence-backed outcome

In a retailer’s customer-facing application, a security correction must preserve legitimate service behavior as well as address the finding.  For an accepted finding, Codex Security can prepare a focused patch and verification evidence. Where safe and practical, it adds a regression test that fails before the fix and passes afterward and checks legitimate behavior. Where testing is unsafe or infeasible, it records the remaining proof gap. Verification does not automatically close the finding.  An Infosys Topaz assessment would connect this capability to acceptance criteria, testing requirements, and issue-tracking practices. Measures would include engineering acceptance, verification effort, and remaining limitations.  Reporting should distinguish a proposed patch, an accepted code change, and remediation verified against agreed checks.

Benefits across industries

The three use cases offer distinct potential benefits to evaluate.  Backlog triage aims to produce clearer decisions about which findings require action. Code-change review examines whether additional security evidence supports better release decisions. Remediation assistance evaluates whether focused changes and validation evidence make corrections easier to review and accept.  These objectives extend beyond the illustrative financial services and retail scenarios. An Infosys Topaz-led approach would adapt the scope, evidence requirements, and acceptance criteria to each client’s applications and operating environment.  The broader opportunity is a repeatable evaluation method, not a uniform promise of faster remediation. Each assessment should establish where AI adds value, where expert judgment remains essential, and where evidence is insufficient.

Build governance into the workflow

Infosys Topaz Responsible AI Suite includes risk assessments, technical guardrails, and advisory offerings through its Scan, Shield, and Steer framework. These provide a basis for assessing the AI risks and governance requirements of a security workflow.  Each engagement must confirm the permitted OpenAI access and delivery arrangements. Enterprise Trusted Access is limited to approved internal work and cannot simply be extended to third-party client services.  The assessment should define authorized assets, permitted data, tool permissions, human review points, and evidence retention. Results must be interpreted within their coverage and verification limits, not treated as a blanket assurance of application security.

Make reviewed action the measure of value

The Infosys–OpenAI collaboration provides a foundation for exploring AI-assisted engineering and security workflows. The case for an Infosys Topaz-led approach is to connect that capability to a specific enterprise decision and evaluate its value before scaling.  Start with one bottleneck, one authorized scope, and clear acceptance criteria. Assess evidence quality, reviewer effort, integration requirements, and operating cost.  The measure of progress is whether teams can move from a credible finding to a decision they trust, a change they accept, and a fix they can verify. That is how AI assistance becomes useful security work.