Recent advances in AI-enabled cyber incidents are reshaping the threat landscape and challenging how we reason about application security, raising questions such as “How do we distinguish an approved business workflow from a threat actor using a valid access token to retrieve sensitive data?” And how reliably do existing controls connect identity, entitlements, and activity across requests and sessions to the intended workflow?
Customers trust Oracle applications to keep critical workflows running and protect sensitive data. That requires adaptive security decisions that identify and address unauthorized activity while allowing legitimate work to continue; without unnecessary red tape.
As threats evolve and scale, keeping pace through reactive updates alone becomes harder. Building on Oracle Cloud Infrastructure’s (OCI) customer first approach, we are developing AI-assisted application security that helps shift the focus toward proactive protection, connecting infrastructure and application signals with business context, continuous validation, and verified remediation.
Why application context matters
Consider a finance integration that retrieves transaction records for reconciliation through an approved interface. Accessing records beyond its usual work could reflect authorized expansion or compromised credentials. Understanding the difference requires evidence about the account’s role, permitted access, records retrieved, and reconciliation workflow.
Restricting access too broadly could interrupt financial work. Overlooking misuse could expose sensitive data. Connecting this evidence supports a targeted correction, with verification that the exposure is addressed, and reconciliation still functions.
Building AI-assisted application security from code to deployment
Our goal is to put protection ahead of an evolving threat landscape. Our AI-assisted application security system helps investigate exposures, validate findings, and guide remediation through three layers.
- Signals and context combine application, identity and infrastructure events to reason about potential exposure.
- Reasoning and validation combine purpose-built security models with specialized AI agents to help recognize patterns, assemble evidence, and test alternative explanations before recommending action.
- Engineering action connects validated findings to approved, verified remediations that address exposure while preserving valid workflows, closing the loop from security signals to verified action.
Signals establish the context
The relevant evidence can span application and API activity, identity and access records, infrastructure controls, and security-test findings. Code scans, vulnerability assessments, penetration tests, and architecture reviews provide additional context for understanding exposure.
Each engagement should establish which sources are available, how current they are, and which application surfaces they cover. A missing source is a coverage limitation, not evidence that the application is safe.
Reasoning and validation establish the finding
At the center of the reasoning and validation layer are two security models developed in-house. Request analysis examines individual application and API events for suspicious content. Behavioral analysis examines activity across requests and sessions, helping identify potential misuse within seemingly legitimate requests.
The architecture uses a mixture-of-experts (MoE) design with specialized experts examining application activity from different perspectives. They examine requests for malicious code, unusual access to employee records, and unexpected program execution. They assess whether user and service-account credentials are used as intended and look for possible backdoors, including unexpected remote-access programs.
Combining findings helps distinguish orchestrated security incidents from legitimate activity. For example, a surge in access to employee records becomes more concerning alongside evidence that a payroll integration account is being misused. These perspectives provide focused hypotheses for validation and targeted remediation. The modular design allows coverage to expand without redesigning the core architecture.
Specialized AI agents and targeted threat hunts test these hypotheses, investigating vulnerabilities, assessing suspicious files and URLs, and gathering corroborating evidence while testing alternative explanations. Findings establish observed activity, affected scope, supporting evidence, and remaining uncertainty before recommending action.
Investigation results, evidence, and recommendations are retained in a persistent knowledge store for recursive learning. Reviewed outcomes feed back into model training, while verified fixes strengthen regression tests, informing subsequent model inferencing.
To support efficient production deployment, security models use a teacher–student architecture. A larger teacher model learns threat patterns from raw and decoded requests during offline training. Through distillation, compact student models learn to reproduce the teacher’s predictions at lower computational cost.
These demonstrations show actual Oracle AI model inference on synthetic data, examining suspicious requests and patterns across related events. Neither includes customer data nor depicts a customer incident.
Engineering action addresses the cause
Engineering action connects validated findings to the code, configuration, or control changes needed to address the exposure. Depending on the cause, this may involve a code review, a tested patch, an architecture review, a permission correction, or an application safeguard. A temporary filter can restrict an exposed path while engineering corrects the underlying defect.
We have developed a shift left workflow that helps carry investigation evidence through control creation, testing, and approved deployment, reducing manual handoffs while preserving the rationale for each change.
Customer-impacting changes require authorization, testing, and a recovery path. Remediation is complete only after verification confirms that the prohibited behavior is restricted, and the intended business workflow still functions.
As this workflow develops, results from deployed controls will feed back into reasoning and evaluation, showing what worked and where protection gaps remain. These outcomes can then inform future recommendations and controls.
Summary
Connecting application, identity, and infrastructure signals with business context helps teams investigate potential exposure and validate findings. Carrying that evidence through approved remediation and verification helps address exposure while preserving legitimate business workflows. Contact your Oracle account team to explore a focused validation of AI-assisted application security.