Cybersecurity
Azul launches free JVM vulnerability scanner as AI-driven threats accelerate
Java runtime vendor Azul is offering a free vulnerability assessment to help organizations find unpatched JVMs, framing the urgency around AI-accelerated exploitation capabilities.
The New Stack
Azul Systems is rolling out a free JVM vulnerability risk assessment targeting DevOps and SecOps teams struggling to maintain visibility across fragmented Java estates. The scanner identifies Java Virtual Machine instances—including embedded and unmanaged runtimes often missed by standard discovery tools—and maps findings against CISA's Known Exploited Vulnerability catalog and the National Vulnerability Database.
The company's pitch hinges on a security-only patch model. Unlike AWS Corretto or Eclipse Temurin, Azul Core ships security fixes in isolation, without bundled feature updates or bug patches. This approach, the company argues, reduces the risk of application breakage during patching cycles—a friction point that leaves many production Java runtimes perpetually outdated.
The AI threat narrative#
Azul frames the urgency around accelerating AI-assisted exploitation. Research cited in the assessment points to a 2024 University of Illinois study showing GPT-4 could autonomously exploit 87% of known critical-severity CVEs at roughly $8.80 per exploit, with AI agent teams succeeding on zero-days at 53% rates. A separate system called ARTEMIS discovered valid vulnerabilities on an 8,000-host network at $18 per hour—outperforming human penetration testers.
However, Azul's headline claim leans on Anthropic's Mythos model—a frontier AI system that remains gated to select organizations and hasn't been publicly tested. Azul's CEO stated Mythos "can now discover and weaponize vulnerabilities on its own," yet when pressed during briefing, the company's product director admitted he lacked access to the model to validate its effectiveness against JVM vulnerabilities. The threat narrative is rooted in capability that Azul itself hasn't independently verified.
What the scan delivers#
The assessment outputs a security dashboard mapping risk by tier, publisher, and Java version; identifies end-of-life instances (Java 5, 6, 7 still in production are "more common than most IT leaders assume"); and flags patch currency gaps. The tool targets compliance frameworks including PCI-DSS, SOX, HIPAA, DORA, and FedRAMP.
Azul notes that typical assessments reveal two to three Java versions account for the bulk of enterprise risk—a finding that "makes mitigation far more tractable than it initially appears."
The free assessment is available through azul.com/jvm-vulnerability-risk-assessment, with the company clearly positioning it as a lead-generation funnel into Azul Core subscriptions.
Read the full story:
