Triage agents: what AppSec platforms automate, and what a person still decides

Why triage first?

Coding agents raise the amount of code and, with it, the number of findings. Before a fix agent can help, something has to decide which findings deserve a fix at all. That is triage.

Four approaches vendors describe

• Reachability. Is the vulnerable code actually called by the application? Endor Labs builds on reachability across dependencies, containers and first-party code.
• Exploitability agents. Cycode's AI Exploitability Agent checks whether a CVE is reachable, as one of the agents under Cycode Maestro.
• Architecture and runtime context. Apiiro's Software Architecture Graph and Risk Graph connect code changes to runtime context.
• Business and exposure context. Legit Security says it prioritizes with reachability and business criticality, and its risk scoring weighs business criticality, compliance, GenAI use, APIs and internet exposure, and its remediation agents prioritize findings before fixing them.

Two more patterns sit next to these. Semgrep Assistant auto-triages findings and uses code context to cut false positives. OX Security combines ASPM correlation with an Agentic Pentester that ties exploitable issues back to code and APIs.

Snyk prioritizes with a Risk Score and reachability; the Risk Score weighs exploit reachability, exploit maturity, business impact, EPSS, CVSS, transitive depth and social trends. Aikido Security lists SCA reachability and EPSS-based prioritization.

What a triage agent should show you

A ranked list is only useful if you can see why an item is ranked. For any automated triage, ask the vendor to show one real finding with:

• the evidence behind its rank (call path, exposure, business tag);
• whether a person can override the rank, and whether the override is recorded;
• what happens to findings ranked low: hidden, deferred or closed.

What stays human

Accepting a risk is a business decision. A triage agent can say a vulnerable function is not reachable today; it cannot decide that a regulated application may ship with a known issue. Keep three things with people:

1. risk acceptance and exceptions, with an owner and an expiry date;
2. the rules that decide what "critical" means for your business;
3. spot checks of findings the agent marked as low priority.

How triage feeds the fix

Triage sets the work order for remediation. A fix agent pointed at an unranked queue spends its effort in arrival order; pointed at a ranked queue, it starts with what matters.

A simple test for any triage agent

Take twenty findings your team has already judged by hand: ten it fixed and ten it accepted or closed. Run them through the vendor's triage and compare the order. Where the agent disagrees with your team, read its evidence. Sometimes the agent is right and the old decision was wrong; sometimes it lacks context only your team has. Either way you learn how much to trust the ranking. The next lesson covers the fix loop itself.