What was the original motivation behind founding Reware Labs?
The original motivation behind Reware Labs came from a pattern I was seeing clearly every year: software security incidents and reported vulnerabilities keep growing exponentially. At the same time, AI is making software development faster and more accessible. That is exciting, but it also means we will produce much more software, and with that, potentially many more security issues. So the question for me became: if AI is accelerating software development, how can we build a security system that can keep up with that pace?
During my PhD, my research focused on AI for code. I studied and developed these models closely, and I saw both their huge potential and their limitations. I realized that AI could be trained not only to generate code, but also to understand security issues, find vulnerabilities, and help fix them. That was the starting point for Reware Labs: using specialized AI to reduce software security risks and make secure development accessible to many more developers and teams.
Many companies already rely on static and dynamic security tools. In your view, where do these tools reach their limits today?
Static and dynamic tools are good at finding known vulnerability patterns, common misconfigurations, and certain runtime issues. But they have an inherent limitation: they usually do not understand the context of the software they are analyzing. The same functionality may be acceptable in a blogging system but become a serious security issue in a banking application. These tools reach their limits when a vulnerability depends on business logic, workflows, user roles, or interactions between services.
For example, a static analyzer may see a piece of code as safe in isolation, while a dynamic analyzer may never trigger the right execution path during testing. But the real vulnerability may only become visible when you understand the full application behavior. So the main limitation today is the lack of system level understanding. They can also produce a lot of noise, especially static analyzers, which can overwhelm security engineers with false positives.
You describe your approach as “context-aware” vulnerability detection. What does that mean in practice – and why is context so important in cybersecurity?
By “context-aware” vulnerability detection, I mean looking beyond isolated code patterns and understanding the software as a system: its business logic, user roles, data flows, workflows, dependencies, and security policies. This matters because many serious vulnerabilities only appear in that broader context, for example workflow bypasses, chained authorization issues, or privilege escalation paths. Context helps reduce false alarms and, more importantly, helps identify behaviors that are actually risky for a specific application. It allows us to understand what the software is intended to do, and where that intended behavior could be misused or abused by an attacker.
AI-generated code is becoming increasingly common. Do you see this creating entirely new types of security vulnerabilities?
I do not think AI generated code necessarily creates completely new classes of vulnerabilities, but it changes the scale and speed of the problem. Many of the security issues may still be familiar, such as insecure authentication, injection flaws, weak access control, or unsafe use of APIs. The difference is that AI can generate these patterns much faster and spread them across many projects, sometimes in subtle ways that developers may not notice. So the main risk is not only new vulnerabilities, but the amplification of existing ones and the creation of code that looks correct, but has hidden security weaknesses.
Your system combines AI models, program analysis, and knowledge databases. How do these components work together in practice?
At a high level, the AI model is the reasoning layer, but for security it cannot work reliably on its own. It needs context about the code, system structure, data flows, dependencies, and known security patterns. Program analysis provides structured facts about how the software behaves, while the knowledge database brings in security knowledge and application specific context. We teach the AI model to use these tools and reason more like a security engineer to understand the system, follow how a vulnerability could actually happen, and judge its real impact in that application.
The idea of autonomous AI agents sounds particularly exciting. How independently can these agents already perform security analyses?
These agents can already go beyond simple detection: they can investigate a potential issue, gather evidence, explain the risk, and propose a concrete fix. Our goal is to build agents that can find and fix vulnerabilities with increasing autonomy, while keeping developers and security teams in control, especially for critical decisions. Over time, the agent should handle more recurring security issues automatically and let experts focus on the complex cases.
What role will human expertise continue to play if AI can identify and remediate vulnerabilities automatically?
Human expertise will remain essential, but AI can make security teams much more effective. In the AI era, the amount of code and security findings will grow, so teams need help with triage and faster reviews. Our system can surface the risks, explain their impact, and suggest fixes, which reduces the time spent on analysis. Humans then focus on the important decisions and edge cases: understanding business impact and handling complex cases where expert judgment is still necessary.
Which industries or application areas are likely to benefit most from your technology?
The first users we see benefiting are teams building software where security and trust are critical, such as finance, healthcare, enterprise SaaS, government, and critical infrastructure. More broadly, any company with complex applications, sensitive data, APIs, and user roles can benefit.
What role has the support from CISPA Helmholtz Center for Information Security played in your journey – especially when it comes to translating research into market-ready security solutions?
The CISPA has been important in giving me both the technical depth and the right environment to build this idea. It exposed me to world class research in AI and software security, while also providing an entrepreneurial environment that encourages researchers to think about practical impact. That combination helped shape Reware Labs from a research insight into a product vision that can solve real-world problems.
And finally: what is your vision for secure software development five years from now?
My vision is that secure software development becomes much more continuous and accessible. As AI democratizes software development, security also has to become part of the workflow for everyone who builds software, not only specialized security teams. In five years, AI agents will work alongside developers from the beginning: understanding the application, detecting risks early, explaining the impact, and helping fix issues before they reach production. The goal is to make secure development easier to practice every day, without slowing teams down.
More information about Reware Labs: rewarelabs.com
