Salesforce says frontier models and an agentic harness now surface more exploitable code vulnerabilities than engineering teams can process. The company’s security leaders describe a bottleneck downstream of discovery: deciding which findings deserve attention and how to group them. AI has accelerated vulnerability discovery faster than validation and remediation have changed; validation still needs environment access, credentials and expert judgment, while fixes follow review and release processes. The result is machine-speed discovery alongside human-speed remediation.

Salesforce organizes remediation around two approaches with different timelines. Its strategic approach finds systemic risks across a codebase and addresses them through architectural fixes; its tactical approach validates and closes specific exploit chains on a faster schedule, from hours to occasional weeks. The approaches work at different pipeline stages: strategic work deduplicates defects during verification and groups findings by shared libraries and sinks at reporting, while tactical work focuses on validation and re-attack to prove a chain works end to end.

The company says findings in deep audits often cluster around a small number of shared causes, such as a platform default, unsafe primitive or missing check. A single bad primitive can generate hundreds or thousands of findings. Fixing a shared architectural cause can retire many findings at once, whereas per-finding remediation requires separate ownership, review, deployment and retesting for each item. Salesforce says systemic remediation gives engineering leaders a manageable set of architectural risks to resource and schedule, but it depends on clear governance and engineering ownership; scaling discovery takes compute, while absorbing its output requires organizational design.

Tactical remediation treats each validated multi-step exploit chain—a sequence of steps assembled into an attack against a specific service—as its own fix, followed by retesting. For its highest-criticality targets, Salesforce runs chains against a live staging instance to distinguish exploitable paths from paths that only appear reachable in static analysis. The company says runtime configuration, feature flags or middleware can block apparent paths, and that the high-confidence findings that pass this validation have had a high success rate as working exploits on real targets. In a recent run, its pipeline found a critical issue that matched an independently filed bug-bounty submission. Setting up each service for testing takes time and service-team context, so Salesforce limits this process to high-criticality targets; it says working container or compose definitions from service teams could make validation more automated.

Salesforce argues that either approach alone leaves gaps: strategic fixes can miss specific validated chains, while tactical-only remediation can overwhelm budgets and engineering queues with individual fixes. Its portfolio combines longer-term architectural cleanup with patches under adversary time pressure. The company advises security leaders to classify systemic risks as a distinct output, assign engineering owners and release plans before scaling discovery, prioritize validated chains by the time available to patch, and build a harness that can swap analysis engines. It says the methodology compounds, while the underlying analysis engine can be replaced; engines should be assessed against the team’s tasks for operator-in-the-loop cost and reliability.

Salesforce says frontier models and an agentic harness now surface more exploitable code vulnerabilities than engineering teams can process. The company’s security leaders describe a bottleneck downstream of discovery: deciding which findings deserve attention and how to group them. AI has accelerated vulnerability discovery faster than validation and remediation have changed; validation still needs environment access, credentials and expert judgment, while fixes follow review and release processes. The result is machine-speed discovery alongside human-speed remediation.

Salesforce organizes remediation around two approaches with different timelines. Its strategic approach finds systemic risks across a codebase and addresses them through architectural fixes; its tactical approach validates and closes specific exploit chains on a faster schedule, from hours to occasional weeks. The approaches work at different pipeline stages: strategic work deduplicates defects during verification and groups findings by shared libraries and sinks at reporting, while tactical work focuses on validation and re-attack to prove a chain works end to end.

The company says findings in deep audits often cluster around a small number of shared causes, such as a platform default, unsafe primitive or missing check. A single bad primitive can generate hundreds or thousands of findings. Fixing a shared architectural cause can retire many findings at once, whereas per-finding remediation requires separate ownership, review, deployment and retesting for each item. Salesforce says systemic remediation gives engineering leaders a manageable set of architectural risks to resource and schedule, but it depends on clear governance and engineering ownership; scaling discovery takes compute, while absorbing its output requires organizational design.

Tactical remediation treats each validated multi-step exploit chain—a sequence of steps assembled into an attack against a specific service—as its own fix, followed by retesting. For its highest-criticality targets, Salesforce runs chains against a live staging instance to distinguish exploitable paths from paths that only appear reachable in static analysis. The company says runtime configuration, feature flags or middleware can block apparent paths, and that the high-confidence findings that pass this validation have had a high success rate as working exploits on real targets. In a recent run, its pipeline found a critical issue that matched an independently filed bug-bounty submission. Setting up each service for testing takes time and service-team context, so Salesforce limits this process to high-criticality targets; it says working container or compose definitions from service teams could make validation more automated.

Salesforce argues that either approach alone leaves gaps: strategic fixes can miss specific validated chains, while tactical-only remediation can overwhelm budgets and engineering queues with individual fixes. Its portfolio combines longer-term architectural cleanup with patches under adversary time pressure. The company advises security leaders to classify systemic risks as a distinct output, assign engineering owners and release plans before scaling discovery, prioritize validated chains by the time available to patch, and build a harness that can swap analysis engines. It says the methodology compounds, while the underlying analysis engine can be replaced; engines should be assessed against the team’s tasks for operator-in-the-loop cost and reliability.