The Security Bottleneck Nobody Talks About

Here's a conversation I had with a security engineer last month:

"We find maybe 5-10 vulnerabilities per week. Sounds good? Wait for it..."

"It takes 4+ hours per vulnerability just to analyze the impact. Which services? Which teams? What's the real risk? Then we write the fix, create the MR, get reviews..."

"By the time we're done, it's been 2 weeks. Vulnerabilities pile up."

This is the story at EVERY organization.

According to industry research, 40% of identified vulnerabilities remain unfixed—not because teams don't care, but because the analysis is paralyzingly slow.

I decided to fix this with AI.

The Problem: Manual Vulnerability Analysis is Broken

Let's break down what security teams actually do with each finding:

Hour 1: Dependency Tracing

"Which services call this vulnerable code?"

Teams manually check:

• Code imports
• Function calls
• Service dependencies
• Cross-repo usage

It's tedious. It's error-prone. It's slow.

Hour 2: Impact Assessment

"How many services are affected?"

Teams need to understand:

• Direct dependencies
• Indirect dependencies (dependencies of dependencies)
• Remote dependencies (3+ hops away)

Most teams give up and guess.

Hour 3: Owner Identification

"Who owns this code?"

Finding the right owner requires:

• Searching CODEOWNERS files
• Checking team docs
• Slack conversations
• Sometimes physical conversations

Hour 4+: Fix Generation

"How do we write secure code?"

For each language, patterns differ:

• Python: Use parameterized queries
• JavaScript: Use prepared statements
• Go: Use database/sql patterns
• Java: Use PreparedStatement
• C#: Use parameterized commands

Teams usually have one expert. That expert gets bottlenecked.

Total: 4+ hours per vulnerability.

For a $150K security engineer, that's $150,000+ in pure analysis overhead per year per team.

The Insight: This Can Be Automated

Three technologies converge here:

1. GitLab Duo Agent - Orchestrates workflow
2. Orbit Knowledge Graph - Knows code dependencies
3. Claude AI - Writes secure code

Combined, they can replace 4+ hours with 45 seconds.

Introducing Orbit Tracer Security Agent

We built Orbit Tracer Security Agent, a GitLab Duo Agent that automates the entire vulnerability remediation workflow.

Here's how it works:

Step 1: Vulnerability Detection (Automatic)

GitLab SAST finds: SQL Injection in database/user_service.py

Step 2: Blast Radius Analysis (Automatic via Orbit)

Agent queries Orbit knowledge graph:

• What calls database/user_service.py?
  • payment_service.py (direct)
  • user_api.py (direct)
  • web_app.js (indirect, calls user_api)
  • mobile_app.js (indirect, calls user_api)

Result: 4 services affected, 12 files impacted

Step 3: Risk Scoring (Automatic via Claude)

Algorithm: Severity × Impact × Exploitability + Compliance

• Severity: 10 (SQL Injection)
• Impact: 10 (affects 4 services)
• Exploitability: 9 (trivial to exploit)
• Compliance: +3 (PCI-DSS violation)

Risk Score: 9/10 (CRITICAL)

Step 4: Owner Identification (Automatic via Orbit)

Agent checks CODEOWNERS:

• Primary: @database-team
• Secondary: @platform-team, @security-team

Notifies: All 3 teams

Step 5: Secure Code Generation (Automatic via Claude)

Agent detects: Python
Generates fix:

def get_user(user_id):
    cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))
    return cursor.fetchone()

Step 6: Human Approval (Optional)

For CRITICAL findings: Requires review
For HIGH findings: Requires review
For MEDIUM/LOW: Auto-approves

MR created with full context.

Total time: 45 seconds. Compared to 4+ hours: 99.8% faster.

The Numbers

Time per vulnerability:    4+ hours → Minutes
Speedup:                   100x - 320x faster
Time saved per team:       40+ hours/month
Annual value per team:     $20,000+
Languages supported:       7+ (Python, JS, Go, Java, C#, C++, Rust)
Vulnerability types:       10 (OWASP Top 10)
Risk accuracy:             Multi-factor, not just CVSS

Technical Highlights

Multi-Factor Risk Scoring

Instead of CVSS alone, we calculate:

Risk Score = (Severity × Impact × Exploitability) / 10 + Compliance Bonus

Where:
- Severity: 1-10 (CVSS mapping)
- Impact: 1-10 (services affected × data type)
- Exploitability: 1-10 (attack surface × auth requirements)
- Compliance: 0-3 (GDPR, PCI-DSS, HIPAA)

This produces nuanced scores:

• SQL Injection in payment system: 10/10
• SQL Injection in read-only analytics: 5/10

Same vulnerability, wildly different risk.

Language-Agnostic Remediation

We separate concepts from implementations:

1. Vulnerability class (SQL Injection)
2. Remediation pattern (Parameterized queries)
3. Language binding (How Python does parameterized queries)

HITL (Human-in-the-Loop)

We don't believe in full automation:

LOW/MEDIUM:    Auto-approve → Auto-merge
HIGH:          Require review → Human approval → Merge
CRITICAL:      Require review → Require security review → Merge

This gives teams both speed AND safety.

Why This Matters

This is built during the GitLab Transcend Hackathon and demonstrates:

1. Duo Agent Potential - AI agents solve real problems
2. Orbit Value - Knowledge graph enables enterprise features
3. Developer Experience - Security can be fast AND safe
4. Market Opportunity - 40% of vulnerabilities go unfixed

What's Next

Phase 1 is complete. Future roadmap:

• Phase 2: Real-time vulnerability tracking dashboard
• Phase 3: Automated scheduled remediation
• Phase 4: Multi-organization enterprise features
• Phase 5: Open source ecosystem and SaaS platform

Try It Out

The project is open source and production-ready. You can explore the complete implementation, test cases, and interactive agent on GitLab.

Feedback Welcome

I'd love to hear your thoughts:

• Security teams: Would this solve your pain points?
• DevOps engineers: How would you integrate this?
• Developers: Interested in contributing?

Let's make security velocity the default. 🚀