Harness, the San Francisco software-delivery company, launched a suite of AI security agents on August 19 built to compress the gap between finding a vulnerability and shipping a fix from weeks to hours. The lineup includes an AI-powered static analysis tool, agentic triage and remediation, a dedicated zero-day agent, and virtual patching.
The company points to a grim asymmetry. The Edgescan 2026 report puts the average time to remediate a vulnerability at 55 days, while the Zero Day Clock has tracked first exploits as fast as six hours after disclosure. Even after a fix is written, the 2025 DORA report says commit-to-production takes more than a week.
Harness’s AI SAST pairs a deterministic dataflow engine with a confidence layer that classifies findings as confirmed risk, potential risk, or contextually safe. The company claims the layer cut false positives by 79 percent on the OWASP Java corpus while lifting precision from 74 to 93 percent. The triage agent weighs CVSS, EPSS, and reachability, tracing call paths so a dependency is flagged only when the vulnerable function is actually reachable. The remediation agent writes a fix, validates it in the pipeline, and opens a human-reviewed pull request.
The zero-day agent skips the queue entirely, mapping blast radius across a customer’s environment in seconds and producing a validated fix. Virtual patching shields production within minutes while the permanent patch is written.
