Tolmo

Software teams now rely on AI coding tools like Claude Codex to ship code faster, but attackers also use AI agents to weaponize vulnerabilities in as little as 1.5 days, according to data the page cites from CISA KEV and VulnCheck KEV sources. Most security teams, by contrast, take about 14 days to respond, leaving a dangerous gap between disclosure and exploitation. Security teams today face isolated alerts from scattered vendors and tools, without full context of how assets across cloud, code, CI, identity, and data stores connect to each other. This makes it hard to assess real exploitability, understand blast radius, or verify that a fix actually resolves the underlying risk.

Tolmo runs a fleet of specialized AI security agents across a company's production stack: a Pentesting Agent that continuously tests live environments like an adversary and proves real exploitability rather than flagging theoretical issues, an Internal Discovery Agent that maps assets and infers cross-service dependencies from configuration across cloud, code, CI, identity, and data stores, and a Remediation Agent that turns findings into verified fixes with graph-grounded review of changes and blast-radius analysis. All three agents work from a shared, continuously updated knowledge graph built from read-only integrations with cloud providers, vendors, and the rest of the stack, requiring no code changes or agents to deploy. The platform also keeps a historical record of this graph, letting teams monitor how the environment and its risks evolve over time.

The page argues that AI has sped up both development and attacks: AI coding tools accelerate shipping, while attacker AI agents now weaponize vulnerabilities in a median of 1.5 days, far faster than the roughly 14 days most security teams take to respond.