When Nick Woodhead spoke with Business Insider on October 23, he had been awake for nearly 48 hours responding to critical PHP vulnerabilities. The CTO of Rothco and Compubox was helping his teams update systems, review logs for signs of compromise, and protect older installations while they waited for backported fixes. His organization already had infrastructure for deploying patches, yet getting through the response still required substantial manual effort.

This experience will be familiar to anyone responsible for securing a portfolio of applications: when a critical vulnerability is disclosed, teams must establish where it exists, identify who owns the affected systems, and work out how to make and verify the necessary changes. Older systems can further add to the workload because teams may need to obtain a backported fix or upgrade to a supported version, then test whether existing application code and dependencies still work. Coordinating those changes across connected applications takes time, especially when testing capacity is limited and services need to remain available.

Those demands become even harder to manage when several disclosures arrive together. In its October 22 analysis, After PHP and eMudhra, Here Comes Node.js, Checkmarx Zero examined a Node.js security release addressing ten vulnerabilities during the same week. Teams responsible for both technologies had another set of updates to assess while their existing application security work continued to wait.

For AppSec leaders, this makes the everyday effort required to investigate and fix findings part of emergency preparedness. An analyst who repeatedly reconstructs the same vulnerability context, or a developer who starts each fix by retracing the investigation, has less time available when an urgent disclosure interrupts the queue. Reducing that repeated manual work can help teams keep routine remediation moving, preserving capacity for the problems that require their attention.

The PHP incident also illustrates why the response must match the vulnerability. The PHP advisory describes an attack path that can execute before application code runs, so affected installations require a runtime update. Application scanning cannot substitute for that patch. The broader lesson for AppSec is to examine the work it can streamline across its own findings: determining whether a vulnerable path is attackable, preparing a proposed change, and giving the developer enough evidence to review it.

That approach aligns with Checkmarx Zero’s recommendations for strengthening application security: Darren Meyer calls for security feedback earlier in development, prioritization informed by exploitability, and assisted AI triage and AI remediation with human approval. Putting those practices into everyday workflows helps teams address issues before they accumulate and reduces the investigation required for those that reach the backlog.

Checkmarx helps teams address vulnerabilities earlier in development and gives AppSec teams and developers the analysis and suggested changes they need to work through findings in the backlog. Recent enhancements extend that support across more of the workflows where teams investigate, review, and fix application risk.

Reduce the work that reaches the backlog

The best time to address a newly introduced coding issue is while the developer still has the relevant code open. Checkmarx Developer Assist brings security analysis and remediation guidance into supported IDE and AI coding workflows, helping developers find issues in human- and AI-generated code, make changes, and rescan their code. In supported autonomous workflows, it can work with the coding agent to repeat remediation and rescanning. Resolving issues at this stage reduces the investigation work passed to AppSec, leaving fewer routine findings competing for attention when a critical disclosure demands an urgent response.

As code moves into pull requests and CI/CD pipelines, the quality of the findings begins to shape the team’s workload. False positives consume investigation time, while missed vulnerabilities remain outside the remediation plan, and both impact the people responsible for both routine application security and urgent response.

Checkmarx Fusion SAST combines Checkmarx’s established security analysis with curated frontier-model reasoning to uncover additional vulnerabilities, while Findings Analysis Engine evaluates and consolidates their results, reducing false-positive noise and duplicate findings.

For an AppSec leader, the practical implication is that backlog size alone gives an incomplete picture of progress. Stronger detection can initially increase the number of known vulnerabilities by uncovering issues that were already present, while a smaller queue can also conceal gaps in coverage. Teams therefore need to understand how much real risk they are finding, how much effort goes into dismissing invalid findings, and how quickly confirmed issues move toward a fix.

Give the next decision a stronger basis

Herein lies the connection between detection quality and triage. Even a correctly identified weakness requires further analysis to determine whether it can be reached and exploited (i.e. attackable) in the application, including whether existing safeguards prevent exploitation. Triage Assist evaluates those conditions for eligible findings, helping reviewers make that decision with supporting evidence. As Fusion expands visibility into real vulnerabilities, AI Triage’s additional analysis helps teams work through the findings and determine which need remediation.

The analysis can set a finding’s state to Confirmed when the issue is reachable and exploitable, or Proposed Not Exploitable when it determines that either condition is absent. Proposed Not Exploitable remains a recommendation for review, so the team can inspect the reasoning before deciding how to treat the finding. The reasoning remains available alongside the finding in Risk Orchestration, together with a record of the state change. Developers and subsequent reviewers can see how the assessment was reached, helping them continue the work without repeating the investigation.

Start preparing fixes without another manual request

Once a finding has been selected for remediation, the next step is to prepare a change a developer can evaluate. Remediation Assist generates suggested fixes for supported vulnerabilities, with guidance available inside Checkmarx One.

Automated AI remediation support removes the need to request each suggestion individually, enabling admins to define the projects, branches, scanners, and severity thresholds in scope. Eligible fixes can be generated after a scan completes or after automated triage finishes when both are enabled. Plus, project overrides let teams adapt those settings where permitted.

With automated remediation enabled, a suggested fix can be ready when a developer picks up an eligible finding. The proposal gives the developer a starting point for reviewing, refining, and testing the change, reducing preparation work while keeping approval and merging within the team’s normal process.

Bring remediation into more development workflows

Checkmarx’s published F1 scores reflect the improvement: 0.64 for its Next-Gen SAST foundation and 0.74 for Fusion SAST. F1 combines precision, the share of reported findings that are real, with recall, the share of actual vulnerabilities detected. Measuring both accounts for the risks a scanner misses as well as the unnecessary work its findings can create. For an AppSec leader, the practical implication is that backlog size alone gives an incomplete picture of progress. Stronger detection can initially increase the number of known vulnerabilities by uncovering issues that were already present, while a smaller queue can also conceal gaps in coverage. Teams therefore need to understand how much real risk they are finding, how much effort goes into dismissing invalid findings, and how quickly confirmed issues move toward a fix.

Give the next decision a stronger basis

Start preparing fixes without another manual request

Bring remediation into more development workflows

A suggested fix is easier to act on when it fits the team’s existing review process. For supported GitHub and Azure DevOps Code Repository Integration projects, Remediation Assist can create separate pull request containing the proposed changes so developers can inspect the diff, discuss adjustments, and approve the fix in the repository where they already manage their code.

Teams using other workflows can also move suggested changes from Checkmarx One into their development environment. Available November 1, options inside Checkmarx One let developers copy a diff, download a patch, or copy a prepared prompt for an AI coding agent. These options support manual and imported projects, with or without an SCM integration, reducing the effort required to turn remediation guidance into a code change.

Developers can apply the proposed patch locally or use the prepared prompt with their coding agent, then review and test the resulting changes. In supported workflows, Developer Assist can rescan the updated code, helping developers check whether the reported issue remains while their tests verify application behavior.

Make progress visible to the people managing risk

During a busy response, opening every finding to discover whether it has been assessed or has a proposed fix creates its own queue. Also scheduled for early November, the new Attackability and Remediation columns in Risk Orchestration bring those outcomes into the SAST and SCA results table, with sorting and filtering to help teams work through them.

Across the program, AI Assist usage analytics provides visibility into triage and remediation activity, developer adoption, and estimated time saved. As with backlog size, activity totals need context. Teams should connect those totals to fixes reviewed, changes deployed, and issues checked again after remediation because a proposed fix or merged pull request alone cannot establish that production exposure has been removed.

Prepare for the next disclosure

The PHP and Node.js disclosures show how quickly urgent security work can compete with the applications teams are still expected to maintain and deliver.

Connecting Developer Assist, Fusion SAST, Triage Assist, and Remediation Assist helps reduce the routine work competing for that engineering time. Security feedback during development lets developers address issues while they still understand the code. As findings reach AppSec, stronger detection and attackability analysis provide evidence for deciding where to act, and suggested changes give developers a starting point for remediation. Reducing the time spent reconstructing context, investigating invalid findings, and preparing fixes helps teams keep everyday security work moving when the next urgent disclosure interrupts their plans.

Those people will still have difficult decisions to make, but they should have the evidence and proposed changes in front of them when they do.