Azul's AI Assistant Surfaces Hidden Java Security Risks in Live Production

Azul, an enterprise Java specialist, unveiled its Intelligence Cloud AI Assistant this week to address a critical gap in how organizations track security and licensing risk across their Java infrastructure. The tool uses natural-language queries to help engineering teams understand which vulnerabilities and licensing violations are present in their live production environments—rather than relying on point-in-time snapshots that quickly become outdated.

The Problem with Static Reports#

Most enterprises still depend on IT asset management (ITAM/SAM) and code-scanning tools that photograph a moment in time. The reality is that Java Virtual Machines (JVMs) are constantly being spun up, patched, rolled back, forgotten, or retired—changes that static reports miss. According to Azul's CEO Scott Sellers, "That used to be a productivity problem. Now that AI can find and weaponize a vulnerability in hours instead of weeks, it's a business risk."

Industry data underscores the urgency. A 2026 Cloud Security Alliance white paper cited by Azul notes that the median time to exploit for known vulnerabilities has collapsed from 32 days to just 5 days—a window far shorter than many organizations' typical patch cycles.

How the Assistant Works#

The AI Assistant sits atop two core Azul services: JVM Inventory, which tracks every JVM instance running anywhere (on-premises, cloud, container), and Code Inventory, which records which code actually executes in production. Engineers can ask conversational questions such as "Which JVMs are running unsupported Java versions?" or "Where is Oracle Java running in production right now?"—and receive answers grounded in live runtime data rather than historical scans.

This matters because drift is common in Java estates. A forgotten node, a rollback, a shadow deployment, or unupdated scripts can unexpectedly resurrect an Oracle Java runtime long after migration efforts, reintroducing licensing and security exposure.

A Crowded But Growing Market#

Azul competes alongside established names in Java runtime security: Contrast Security (JVM agent instrumentation), Dynatrace (runtime vulnerability analytics), Fortify (RASP agents), Imperva (runtime anomaly detection), and Datadog (distributed tracing and APM).

Andrew Krug, head of security advocacy at Datadog, tells The New Stack that static SBOMs can be bypassed during deployment, and that "runtime context is absolutely critical for understanding the real risk in the production environment." He also notes an uptick in automated, AI-driven attacks targeting known Java vulnerabilities—a trend that makes point-in-time scans even less reliable.