{"id":496,"date":"2026-10-27T09:56:43","date_gmt":"2026-10-27T04:26:43","guid":{"rendered":"https:\/\/blogs.infosys.com\/topaz\/?p=496"},"modified":"2026-10-27T09:56:43","modified_gmt":"2026-10-27T04:26:43","slug":"rethinking-vulnerability-remediation-with-infosys-topaz-and-openai-daybreak","status":"publish","type":"post","link":"https:\/\/blogs.infosys.com\/topaz\/openai\/rethinking-vulnerability-remediation-with-infosys-topaz-and-openai-daybreak.html","title":{"rendered":"Rethinking Vulnerability Remediation with Infosys Topaz and OpenAI Daybreak"},"content":{"rendered":"

\"\"Enterprise AI creates value when it improves how work gets done. In cybersecurity, that means helping teams turn vulnerability findings into decisions and corrections they can review, implement, and verify. The harder problem is rarely spotting the vulnerability, it\u2019s acting on it: prioritizing what matters against real business risk, closing the gap quickly, and proving the fix held. Doing that reliably takes more than a capable model; it takes enterprise context and the platform to operationalize it.<\/p>\n

Infosys Topaz<\/a> brings together AI-first services, solutions, and platforms using generative AI. The Infosys\u2013OpenAI collaboration extends this enterprise focus by combining OpenAI technology with Infosys Topaz Fabric, its composable, open agentic services suite.\u00a0 For security leaders, this creates an opportunity to explore how AI-assisted investigation and engineering can fit into existing security practices. An Infosys Topaz-led approach would start with the business problem, connect the relevant capabilities to the client\u2019s workflow, and evaluate whether they improve decisions before expanding adoption.<\/p>\n

Why security findings need further investigation<\/strong><\/p>\n

Identifying a possible vulnerability starts a chain of work. Teams must determine whether it affects their software, examine supporting evidence, identify the responsible engineering team, and establish a safe correction.\u00a0\u00a0A finding may lack sufficient application context. A proposed patch may need additional testing. A completed review may leave questions unresolved. These are different situations, and each requires a different decision.\u00a0\u00a0The enterprise challenge is therefore broader than detection. More alerts or generated patches do not, by themselves, demonstrate progress. A useful security workflow must connect findings to ownership, review, testing, and a clear record of what remains unresolved.<\/p>\n

How Infosys Topaz and OpenAI work together<\/strong><\/p>\n

The Infosys\u2013OpenAI collaboration<\/a> focuses on practical, responsible enterprise deployment, with an early emphasis on software engineering, modernization, and DevOps. Its announced applications include code review automation and vulnerability detection.\u00a0\u00a0That engineering focus is relevant to security teams: detecting a possible issue is useful only when it leads to a decision about what to review and fix. OpenAI Daybreak<\/a> brings together frontier models, codex security<\/a>, responsible access, and the security harness. Its documented workflows include repository investigation, vulnerability-backlog triage, pull-request security review, and assistance with focused fixes.\u00a0\u00a0An Infosys Topaz-led assessment would connect these capabilities to the client\u2019s application context, engineering practices, and governance requirements. The approach would establish where AI assistance belongs, what reviewers must verify, and how its contribution should be measured.\u00a0\u00a0The following three use cases illustrate this assessment approach, not completed client deployments.<\/p>\n

Make vulnerability backlogs actionable<\/strong><\/p>\n

Consider a financial institution reviewing a backlog of scanner findings. Reviewers need to determine whether a reported issue applies to the current code, whether existing controls address it, and what evidence developers need before accepting a ticket.\u00a0\u00a0Codex Security can investigate scanner results, dependency alerts, advisories, and tickets against repository context. It examines claims and relevant code paths, checks existing controls, and explains whether the evidence supports action, suggests the issue is not applicable, or requires further review. These complements established scanners.\u00a0 An Infosys Topaz assessment would begin with one approved application and a representative backlog. Security and engineering teams would agree on the evidence needed to accept, reject, or escalate a finding.\u00a0\u00a0The evaluation would compare decision time, reviewer acceptance, and unresolved evidence gaps with the existing process. Processing more findings would matter only if the resulting decisions became more useful.<\/p>\n

Bring security decisions closer to code changes<\/strong><\/p>\n

A change to an account-management service can raise an important release question: which security assumptions changed, and does the available evidence address the concern?\u00a0\u00a0Codex Security Review analyzes GitHub pull-request changes alongside repository context and configured threat models or security guidance. Its reports include supporting evidence, attack paths, validation details, and remediation guidance.\u00a0\u00a0Infosys\u2019s application security and DevSecOps services include designing, deploying, operating, and sustaining security gates across the software development lifecycle. This provides relevant experience for assessing where an additional AI-assisted review would fit.\u00a0\u00a0An Infosys Topaz-led evaluation would start with one repository, named reviewers, and explicit handling of incomplete results. Success would depend on the usefulness of the evidence and the additional review effort. Release authority would remain with the customer.<\/p>\n

Turn remediation into an evidence-backed outcome<\/strong><\/p>\n

In a retailer\u2019s customer-facing application, a security correction must preserve legitimate service behavior as well as address the finding.\u00a0\u00a0For an accepted finding, Codex Security can prepare a focused patch and verification evidence. Where safe and practical, it adds a regression test that fails before the fix and passes afterward and checks legitimate behavior. Where testing is unsafe or infeasible, it records the remaining proof gap. Verification does not automatically close the finding.\u00a0 An Infosys Topaz assessment would connect this capability to acceptance criteria, testing requirements, and issue-tracking practices. Measures would include engineering acceptance, verification effort, and remaining limitations.\u00a0\u00a0Reporting should distinguish a proposed patch, an accepted code change, and remediation verified against agreed checks.<\/p>\n

Benefits across industries<\/strong><\/p>\n

The three use cases offer distinct potential benefits to evaluate.\u00a0\u00a0Backlog triage aims to produce clearer decisions about which findings require action. Code-change review examines whether additional security evidence supports better release decisions. Remediation assistance evaluates whether focused changes and validation evidence make corrections easier to review and accept.\u00a0\u00a0These objectives extend beyond the illustrative financial services and retail scenarios. An Infosys Topaz-led approach would adapt the scope, evidence requirements, and acceptance criteria to each client\u2019s applications and operating environment.\u00a0\u00a0The broader opportunity is a repeatable evaluation method, not a uniform promise of faster remediation. Each assessment should establish where AI adds value, where expert judgment remains essential, and where evidence is insufficient.<\/p>\n

Build governance into the workflow<\/strong><\/p>\n

Infosys Topaz Responsible AI Suite<\/a> includes risk assessments, technical guardrails, and advisory offerings through its Scan, Shield, and Steer framework. These provide a basis for assessing the AI risks and governance requirements of a security workflow.\u00a0\u00a0Each engagement must confirm the permitted OpenAI access and delivery arrangements. Enterprise Trusted Access is limited to approved internal work and cannot simply be extended to third-party client services.\u00a0\u00a0The assessment should define authorized assets, permitted data, tool permissions, human review points, and evidence retention. Results must be interpreted within their coverage and verification limits, not treated as a blanket assurance of application security.<\/p>\n

Make reviewed action the measure of value<\/strong><\/p>\n

The Infosys\u2013OpenAI collaboration provides a foundation for exploring AI-assisted engineering and security workflows. The case for an Infosys Topaz-led approach is to connect that capability to a specific enterprise decision and evaluate its value before scaling.\u00a0\u00a0Start with one bottleneck, one authorized scope, and clear acceptance criteria. Assess evidence quality, reviewer effort, integration requirements, and operating cost.\u00a0\u00a0The measure of progress is whether teams can move from a credible finding to a decision they trust, a change they accept, and a fix they can verify. That is how AI assistance becomes useful security work.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Enterprise AI creates value when it improves how work gets done. In cybersecurity, that […]<\/p>\n","protected":false},"author":1164,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[27],"tags":[],"coauthors":[59],"class_list":["post-496","post","type-post","status-publish","format-standard","hentry","category-openai"],"acf":[],"_links":{"self":[{"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/posts\/496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/users\/1164"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/comments?post=496"}],"version-history":[{"count":4,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/posts\/496\/revisions"}],"predecessor-version":[{"id":502,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/posts\/496\/revisions\/502"}],"wp:attachment":[{"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/media?parent=496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/categories?post=496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/tags?post=496"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.infosys.com\/topaz\/wp-json\/wp\/v2\/coauthors?post=496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}