Opened Is Not Fixed: Shayaun Nejad on the Last Mile of AI Vulnerability Remediation ([un]prompted II)

"Opened is not fixed" sounds obvious and then costs a quarter. Shayaun Nejad (Rubrik) is giving the talk that takes the sentence literally at [un]prompted II — most people type it unprompted — and of the 85 session slots in our full guide to the conference, this is the one we would send to a CISO who has already bought an AI code scanner. The disputable version of his title: your AI vulnerability programme does not have a remediation problem, it has an adjudication problem, and on a dashboard the two look identical.

Nejad speaks on Day 1, Stage 2, at 16:20, per the official agenda as published on 2026-10-12. This piece is written from that published abstract, before the talk. We are independent coverage — not the organiser, not a sponsor, not a media partner — and we are following remotely, not from the room. Nothing here is a quote from anyone, and agendas change.

What the talk says it will show

The abstract promises a field report on moving an AI-found vulnerability from a verified finding to one of three terminal states: a merge, a rejection, or a formal risk acceptance. It names three mechanics — deduplication, ownership, and the reason a passing build does not prove a fix.

Note what that is not: a discovery talk, and the programme is thick with those. Nejad starts where they stop, at the moment a finding becomes somebody's work item.

Why the last mile is the hardest slot on the unprompted agenda

Two other sessions supply the numbers that make this the most commercially useful talk on the programme.

David Molnar (Meta) reports about 90% coverage on targets and over 40% of critical vulnerabilities fixed by AI-written diffs — and that faster fixes did not automatically shorten time-to-fix. Read that again. The diffs got written. The criticals got closed. The clock did not move. Whatever consumed the saved time, it was not writing the patch.

Tobias Heldt (Co-Founder and CEO, XOR) holds the other end. Frontier agents went at his company's own privately disclosed zero-days: of 54 attempts, 12 working exploits and 0 accepted patches. One reported failure was a fix that blocked valid messages, which is the last mile compressed into a sentence. An exploit is graded by a crash. A patch is graded by a human who still has to keep the product working.

Put those two results side by side and the shape is unambiguous: generation scaled, adjudication did not. It is thread three of six arguments running through the conference, and the only one with a price tag.

The three mechanics, and where each one breaks

Mechanic	Why it breaks under AI volume
Deduplication	A stochastic finder has no stable finding set. Petr Simecek (AISLE) reports 25,000 trials and 7,600 CVE rediscovery runs in which a scanner misses a real bug on one run and finds it on the next. Buy coverage by re-running and you buy a deduplication problem with it.
Ownership	Farzan Karimi (Deputy CISO, Moderna) reports 687 security reviews in 30 days from one in-house agent and says the hard part was reliable system and ownership data — not the reasoning. A finding with no owner is not a finding; it is a row.
Evidence of fix	A green build proves you did not break the tests you already had. It does not prove the vulnerable path is gone, and against an AI-written diff that distinction is the entire control.

We hit the same wall from the discovery side in what AI-discovered vulnerabilities change, and set out the acceptable-evidence problem in audit log evidence for agentic systems.

What we will be watching for

• A merge rate, or any denominator at all. "Findings closed" without "findings merged" is the number that hides the problem.
• Whether rejection is a tracked outcome with a reason code, or an untracked backlog death.
• What counts as evidence of a fix beyond CI — a regression test derived from the finding, a re-run of the finder, a proof-of-vulnerability that now fails.
• How an unowned finding gets an owner, and who holds it meanwhile.
• Whether formal risk acceptance is a signed, expiring state or a polite "wontfix".

If this holds, what changes on Monday

Stop reporting findings. Report terminal states, each with a deadline: merged, rejected with a reason, accepted with an expiry date and a name. Everything else is work in progress, which is the metric that matters.

Then make the finder produce the test. If a finding cannot be expressed as a check that fails before the diff and passes after it, you have no evidence of a fix.

Three questions we would ask Shayaun Nejad

1. What is the real merge rate on AI-found findings, with the denominator stated — and how much of the gap is rejection versus silence?
2. When a verified finding has no owner, who holds it, and what happens to it after thirty days?
3. What single piece of evidence, other than a passing build, is enough to close one?