paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Software Vulnerability Management in the Era of Artificial Intelligence: An Industry Perspective

人工智能时代的软件漏洞管理:行业视角
ICSE Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering2026匹配度 3/10 · 论文是面向软件漏洞管理中 AI 工具采用情况的行业调查研究,属于 AI for 软件工程/安全方向,与用户关注的"静态分析/程序分析"技术本身(PL→AI 或 AI→PL)只有间接关联,且不含形式化方法、程序分析技术或 benchmark 设计。其工业落地视角虽符合用户偏好,但内容停留在采用障碍与治理层面,未触及静态分析或浮点/贝叶斯程序分析。引用 1 inbox
M. Mehdi Kholoosi, Triet Huynh Minh Le, M. Ali Babar
crossref: 2026-09-12dblp: 2026-09-12arxiv: 2026-09-12

AI 速览

一句话:基于60名从业者调查,揭示AI工具在软件漏洞管理中的采用现状、障碍与改进建议。

人工智能正改变软件开发,但 AI 驱动的软件漏洞管理(SVM)工具在产业中的采用仍缺乏实证。本文报告一项覆盖 27 个国家、60 名从业者的混合方法问卷调查,量化分析采用趋势,并定性总结工具优势、实践挑战与改进机会。结果显示,AI 工具已贯穿 SVM 生命周期,69% 使用者对当前使用表示满意;从业者认可其速度、覆盖范围与可访问性,但误报、缺少上下文和信任问题普遍存在。研究进一步发现一种社会技术采纳模式:AI 输出需经人工监督与组织治理过滤。作者据此建议提升可解释性、上下文感知、集成工作流与验证实践,为从业者、工具开发者和研究者提供指导。

问题
AI 驱动的软件漏洞管理(SVM)工具在产业中的实际采用程度、障碍与促进因素尚不清楚。
方法
对 27 个国家 60 名从业者开展包含定量与定性问题的问卷调查,分析采用趋势、工具优势、挑战和改进机会。
评估
通过问卷的定量与定性分析,发现 AI 工具贯穿 SVM 生命周期,69% 用户满意,同时揭示误报、缺上下文、信任问题及社会技术采纳模式。
原文摘要(Abstract)

Artificial Intelligence (AI) has revolutionized software development, particularly by automating repetitive tasks and improving developer productivity. While these advancements are well-documented, the use of AI-powered tools for Software Vulnerability Management (SVM), such as vulnerability detection and repair, remains underexplored in industry settings. To bridge this gap, our study aims to determine the extent of the adoption of AI-powered tools for SVM, identify barriers and facilitators to the use, and gather insights to help improve the tools to meet industry needs better. We conducted a survey study involving 60 practitioners from diverse industry sectors across 27 countries. The survey incorporates both quantitative and qualitative questions to analyze the adoption trends, assess tool strengths, identify practical challenges, and uncover opportunities for improvement. Our findings indicate that AI-powered tools are used throughout the SVM life cycle, with 69% of users reporting satisfaction with their current use. Practitioners value these tools for their speed, coverage, and accessibility. However, concerns about false positives, missing context, and trust issues remain prevalent. We observe a socio-technical adoption pattern in which AI outputs are filtered through human oversight and organizational governance. To support safe and effective use of AI for SVM, we recommend improvements in explainability, contextual awareness, integration workflows, and validation practices. We assert that these findings can offer practical guidance for practitioners, tool developers, and researchers seeking to enhance secure software development through the use of AI.

链接与引用

DOI 原文 · arXiv · DBLP

BibTeX
@inproceedings{abs-2512-18261,
  title = {Software Vulnerability Management in the Era of Artificial Intelligence: An Industry Perspective},
  author = {M. Mehdi Kholoosi and Triet Huynh Minh Le and M. Ali Babar},
  booktitle = {ICSE},
  year = {2026},
  doi = {10.1145/3744916.3787781}
}