一句话:基于60名从业者调查,揭示AI工具在软件漏洞管理中的采用现状、障碍与改进建议。
人工智能正改变软件开发,但 AI 驱动的软件漏洞管理(SVM)工具在产业中的采用仍缺乏实证。本文报告一项覆盖 27 个国家、60 名从业者的混合方法问卷调查,量化分析采用趋势,并定性总结工具优势、实践挑战与改进机会。结果显示,AI 工具已贯穿 SVM 生命周期,69% 使用者对当前使用表示满意;从业者认可其速度、覆盖范围与可访问性,但误报、缺少上下文和信任问题普遍存在。研究进一步发现一种社会技术采纳模式:AI 输出需经人工监督与组织治理过滤。作者据此建议提升可解释性、上下文感知、集成工作流与验证实践,为从业者、工具开发者和研究者提供指导。
Artificial Intelligence (AI) has revolutionized software development, particularly by automating repetitive tasks and improving developer productivity. While these advancements are well-documented, the use of AI-powered tools for Software Vulnerability Management (SVM), such as vulnerability detection and repair, remains underexplored in industry settings. To bridge this gap, our study aims to determine the extent of the adoption of AI-powered tools for SVM, identify barriers and facilitators to the use, and gather insights to help improve the tools to meet industry needs better. We conducted a survey study involving 60 practitioners from diverse industry sectors across 27 countries. The survey incorporates both quantitative and qualitative questions to analyze the adoption trends, assess tool strengths, identify practical challenges, and uncover opportunities for improvement. Our findings indicate that AI-powered tools are used throughout the SVM life cycle, with 69% of users reporting satisfaction with their current use. Practitioners value these tools for their speed, coverage, and accessibility. However, concerns about false positives, missing context, and trust issues remain prevalent. We observe a socio-technical adoption pattern in which AI outputs are filtered through human oversight and organizational governance. To support safe and effective use of AI for SVM, we recommend improvements in explainability, contextual awareness, integration workflows, and validation practices. We assert that these findings can offer practical guidance for practitioners, tool developers, and researchers seeking to enhance secure software development through the use of AI.
@inproceedings{abs-2512-18261,
title = {Software Vulnerability Management in the Era of Artificial Intelligence: An Industry Perspective},
author = {M. Mehdi Kholoosi and Triet Huynh Minh Le and M. Ali Babar},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3787781}
}