ArmourCode launches Zero to cut vulnerability backlogs. Wed, 4th Nov 2026 (Today) ArmourCode has launched ArmourCode Zero, an agent-based product designed to help security teams reduce vulnerability backlogs. The system focuses on fixes rather than raw findings. Zero reads vulnerability findings, prepares an initial triage assessment, and groups issues by the change needed to resolve them. According to ArmourCode, this can cut the number of actions security teams need to process by combining multiple findings into a smaller set of fixes, such as a single dependency upgrade that clears several alerts. In one customer example cited by ArmourCode, a tenant with about 28,600 findings was reduced to about 8,900 fixes. That amounted to 69% fewer items to work through, with fixes ranked by the amount of risk each one removed. The product also connects to coding agents already used by engineering teams, including Claude Code, Codex, and Muse Code, and drafts code changes in a pull request for human review. A fix is counted only once the exact commit has been rescanned and the original finding no longer appears. Backlog focus The launch reflects a wider shift in cyber security as companies try to manage a growing volume of vulnerabilities while attackers use automation and AI tools to shorten the time between discovery and exploitation. ArmourCode argued that traditional approaches have focused too heavily on identifying issues rather than closing them. Phil Venables, a Board Member at ArmourCode, framed the issue in stark terms in comments cited by the company. "We're clearly going to be in a race to respond at machine speed to machine speed attacks," Venables said. ArmourCode said its platform processes more than 400 billion findings a year, more than 1 billion MCP and API calls, and more than 1 billion agentic actions through more than 100,000 agents deployed across its customer base. Zero sits on top of that platform and uses the company's Context Risk Graph, which links findings to assets, code, owners, services, and controls across an organisation. That context is central to how the product prioritises work. ArmourCode gave the example of the same critical vulnerability carrying very different urgency depending on whether it sits on an isolated test server or an internet-facing payment service. Autonomic model ArmourCode ties the new product to a broader model of "autonomic" cyber defence, in which systems monitor, analyse, plan, and execute actions with human oversight. The company mapped Zero to a five-step loop covering the continuous intake of findings, triage and recommendation, grouping of fixes, drafting of remediation work, and the use of a shared knowledge base. Under that model, human users still approve consequential actions. Users can edit, confirm, or undo each action card, while secrets are redacted before any model call and customers can use their own model keys. ArmourCode presented that control structure as necessary to build trust in automated remediation. It said evidence gathered through rescanning is used to verify whether a fix has worked, and that false positives can also be documented with supporting evidence. Zero is being opened first to a limited group of customers. ArmourCode said it wants to test the product with teams handling real vulnerability backlogs before expanding access more broadly. The product marks the latest attempt by security software vendors to apply generative AI and workflow automation to vulnerability management, an area where large enterprises often face hundreds of thousands or even millions of open findings. Rather than adding another dashboard, ArmourCode is pitching Zero as a tool that turns findings into a smaller list of ranked remediation tasks and tracks progress through verified fixes. "Trust in an autonomic system is earned one verified fix at a time," Venables said.

SOCRadar Attack Surface Management now integrates with ArmorCode ASPM. Your team has a process for triaging vulnerabilities. The question is whether findings from your external attack surface ever reach it. An internet-facing asset carrying a critical CVE may be sitting outside the system your application security team reviews each day. When analysts have to move findings between tools and repeat status updates by hand, even a clear vulnerability alert turns into extra work and conflicting records of what still needs attention. SOCRadar's external vulnerability findings now flow natively into ArmorCode Application Security Posture Management, and the decisions your analysts make there flow back to SOCRadar. An ASPM platform can only Manage what it knows about. ArmorCode is built to consolidate, prioritize, and drive remediation across findings. Discovering what your organization has exposed on the internet is a separate discipline: continuously mapping domains, subdomains, IPs, cloud assets, certificates, and services that belong to you, including the ones no one told the security team about. Shadow IT, a forgotten staging environment, a subsidiary's domain, an asset spun up outside the change process: none of these appear in a scanner's target list because nobody added them. A vulnerability on such an asset goes unaddressed because the asset was never in scope. Prioritization depends on asset context. Prioritization takes more than collecting alerts. CISA recommends that organizations monitor its Known Exploited Vulnerabilities catalog and prioritize remediation of the vulnerabilities it lists. Acting on guidance like that requires knowing which of your assets are affected, which application each asset belongs to, and what work is already underway. The coordination problem continues after triage. If an analyst adjusts severity or records that a finding has been remediated in one platform, the source system needs to reflect that decision. Otherwise, a colleague reviewing the original alert repeats an investigation or asks for work that is already done. A useful integration has to carry findings in and decisions back. Where the findings come from: SOCRadar Attack Surface Management. SOCRadar Attack Surface Management continuously discovers your external-facing assets and identifies the vulnerabilities affecting them. For this integration, ASM supplies both halves of what an analyst needs to start work: the vulnerability finding and the affected-asset context around it. What ASM contributes: * Discovery of assets across your external attack surface, including ones outside your inventory * Identification of vulnerabilities affecting those exposed assets * CVE, CVSS, CWE, and severity detail for triage * A concrete link between each vulnerability finding and the asset it affects ASM is one module of the wider SOCRadar Extended Threat Intelligence Platform, which also covers Dark Web monitoring, brand protection and takedown services, supply chain intelligence, and vulnerability intelligence. Integration with ArmorCode. The integration is native and bidirectional, connecting the two platforms over an API with no middleware or custom scripts. Findings in: ArmorCode ingests SOCRadar ASM findings on your configured scan schedule, carrying CVE, CVSS, CWE, severity, and affected-asset information. The integration also discovers SOCRadar assets and maps them into ArmorCode's Group " Subgroup " Environment structure, so external findings arrive inside the organizational model your teams already use. Decisions back: Status and severity changes made in ArmorCode are pushed back to SOCRadar. Status mappings are: | ArmorCode status | SOCRadar status | | Remediated | RESOLVED | | Triage | INVESTIGATING | | False Positive | FALSE_POSITIVE | Severity updates map one-to-one. Synchronization is available only for findings that carry a SOCRadar alarm_id. The connector is a connection layer that carries findings you are already licensed to receive from SOCRadar into ArmorCode. Enabling it does not grant access to SOCRadar data on its own. Requires the ASM module and Company API access: Authentication uses your SOCRadar Company API Key and Company ID. For bidirectional updates, you must also configure a fixed Acting User Email belonging to a registered SOCRadar user. If that email is not registered, the push fails silently on the ArmorCode side. When reviewing activity history, note that severity updates sent from ArmorCode appear as Manual in SOCRadar due to a limitation in the SOCRadar severity API; status updates are attributed correctly. How it works in practice. You open ArmorCode after a scheduled import and find a high-severity SOCRadar finding affecting a public-facing application. You review its CVE, CVSS, and CWE detail, then use the affected asset and its Group " Subgroup " Environment mapping to see where it belongs and which team owns it. You start the investigation without first copying the finding into another record. You set the finding to Triage in ArmorCode; the SOCRadar status becomes INVESTIGATING. If your assessment calls for a severity change, that goes back too. After the application team ships the fix and you validate it, you mark the finding Remediated, and SOCRadar records RESOLVED. The asset in that scenario matters as much as the workflow. SOCRadar discovered it as part of your external attack surface, which is why the vulnerability reached a triage queue at all. Take the next step. For teams already running ArmorCode, this integration brings SOCRadar's external vulnerability findings into an established ASPM workflow and keeps status and severity decisions connected to the source findings. Your analysts spend less effort transferring records and more time on the vulnerabilities those records describe. ArmorCode is one of many destinations SOCRadar feeds. The same intelligence reaches SIEM, SOAR, TIP, ITSM, and vulnerability management tools across the SOCRadar integrations ecosystem, so standardizing on SOCRadar as the source of external findings does not tie you to a single workflow surface. Enable the connector in ArmorCode under Manage " Security Tools " SOCRadar. Setup takes about 10 minutes; have your Company API Key, Company ID, and registered Acting User Email ready. In the SOCRadar platform, Settings " API & Integrations " Integrations " ArmorCode Integration holds the setup guide, field and status mappings, and troubleshooting. Contact your SOCRadar Customer Success Manager or sales team to confirm ASM module and Company API access.