As the software landscape undergoes a rapid transformation driven by frontier artificial intelligence and autonomous agents, the challenge of securing applications has reached a critical juncture. Recognizing this pivotal moment, GRC Outlook has named Waratek as the AI-Generated Vulnerabilities Solution Provider of the year 2026.

This recognition highlights Waratek’s pioneering work in delivering advanced runtime security solutions designed to protect enterprise applications from the unique risks introduced by human and AI-developed code. As development and teams increasingly rely on artificial intelligence to generate code at unprecedented speeds, conventional security scanning methods are failing to keep pace. Security teams use AI to develop patches to address known flaws found in applications already in production to increase the pace of patching.

By shifting security directly into the application execution environment, Waratek delivers a modern, autonomous defense framework that safeguards software from pre-production testing through to live production. That’s important because the sheer number of code flaws being discovered by AI-driven tools are overwhelming security teams.

By August 2026, Oracle had released 3,532 patches, more than past two years combined! During the same time period, MS was less than 100 security fixes away from exceeding 2025’s total with four months left in the year.

It’s no secret that the rapid adoption of artificial intelligence in software development has fundamentally altered how code is written and deployed, too. While recent industry studies show that AI-assisted development accelerates feature delivery, nearly 45 percent of AI-generated code contains security vulnerabilities. And AI written patches, according to one recent study, introducew more bugs 44 percent of the time. (And about the same number of patches break the app.)

Generative models construct code patterns that appear syntactically sound to human reviewers and legacy linters, yet contain subtle logic flaws, insecure deserialization, and dangerous input handling flaws. These flaws are further exacerbated by the rise of agentic threats and automated vulnerability research tools that can discover and rapidly weaponize zero-day exploits in under an hour.

Traditional static and dynamic application security testing tools struggle in this new environment. Static analysis (SAST) relies on probabilistic guesswork, leading to severe false positive fatigue and bloated developer backlogs, while dynamic analysis (DAST) treats the application as a black box without internal execution visibility.

This environment has created a severe operational crisis within many enterprises. Survey data reveals a 42 percent perception gap between leadership and security practitioners, where 57 percent of executives believe remediation service level agreements are being met while only 15 percent of practitioners agree.

Recent industry data reveals a hard pill to swallow: LLMs have the lowest resolution rate of any application type. Only 38% of high-risk AI issues actually get fixed. This means a staggering 62% of critical vulnerabilities in AI-driven applications remain “deferred” or ignored, leaving organizations exposed to common attacks. As organizations rush to deploy AI capabilities, manual review processes force teams to choose between delaying market releases or accumulating dangerous security debt.

“As organizations rush to integrate artificial intelligence into their software pipelines, traditional security models simply cannot match the velocity of machine-generated code and all that comes with that,” states Doug Ennis, Chair and Chief Executive Officer of Waratek. “Our mission is to eliminate the false choice between rapid innovation and rigorous protection. By embedding security directly into the application runtime, we enable enterprises to move at maximum speed while maintaining complete, autonomous defense against both known and unseen threats.”

Waratek addresses the pre-production vulnerabilities of human and AI generated code through its Interactive Application Security Testing solution. Operating from within the application runtime during testing, Waratek IAST observes exact execution paths and data flows in real time, only identifying genuine, exploitable vulnerabilities and reporting the exact file and line number without false positives. This allows engineering teams to catch and correct AI-generated flaws instantly during automated build testing without slowing down sprint cycles or triaging phantom alerts.

For production environments where unpatched flaws or zero-day exploits inevitably surface, Waratek provides Runtime Application Self-Protection. Waratek RASP is installed at the application virtualization layer, such as the Java Virtual Machine (JVM) where the solution continuously monitors application behavior against deterministic execution boundaries.

When an exploit targets a known or Zero-Day AI or human created vulnerability to alter the intended operation of an app, Waratek RASP instantly blocks the unauthorized action at the compiler level through immutable rules. Additionally, the platform provides virtual patching capabilities, shielding vulnerable code in live environments without requiring source code modifications, application restarts, operational downtime, or tuning.

“Relying on manual patch cycles or predictive scanners in an age of agentic AI attacks is no longer viable,” adds Ennis. “Waratek shifts the focus by providing deterministic execution intelligence that stops exploits in their tracks without requiring code changes, development friction, or scheduled maintenance windows.”

By unifying pre-production testing and production defense into a complimentary solution suite, Waratek bridges the divide between executive governance and daily security operations. Leadership gains verifiable compliance reporting based on active runtime shielding, while engineering teams are relieved from the burden of unmanageable vulnerability backlogs.

This dual-layer runtime approach ensures that as software development transitions into an era dominated by autonomous code generation, enterprises can confidently harness artificial intelligence without sacrificing security or operational resilience.

About Waratek:

Based in Dublin and Chicago, Waratek provides runtime application security that protects software from exploits at the point of execution including vulnerabilities introduced by AI and human-generated code. Waratek eliminates entire classes of exploits with zero source code changes, zero downtime, zero signatures, and zero configuration. The world’s most security-conscious organizations rely on Waratek to defend mission-critical applications and meet evolving compliance requirements.