We proactively fixed ~100 security issues in 6 days with 0 humans

Ramp’s security team makes the case for building your own security agents rather than buying them, on the grounds that you already know how to find, validate and fix vulnerabilities in your own environment, and a home-grown team of agents fits your specific environment, priorities, and threat model better than anything on the market today.

The pipeline has five stages. A coordinator holds a skill per vulnerability class and launches detector agents in parallel, each a specialist in one class, briefed with a definition, the steps an analyst would take, the usual impact and real examples from the codebase. Manager agents then argue against what the detectors found. A validator writes an integration test that reproduces the issue and only passes if the endpoint is secure, which catches false positives the earlier stages let through. Finally a fixer works test-first against that test and opens a PR, where a human takes over to review and land it.

The claim is nearly 100 latent issues found and patched, some high severity, none of which had been turned up by penetration testing, bug bounty, static analysis or trials of more than ten code-scanning vendors. Worth being precise about the numbers, because the headline compresses them. The 40% figure is not a false-positive reduction rate for the whole run: in initial testing on a sample of findings, managers rejected 40% of the original proposals, and a human confirmed all of those rejections were genuine false positives. The timeline is a four-hour hackathon plus less than a week of work by one team member, and everything was patched within a week of discovery. “0 humans” is the author’s own qualified phrasing, since humans reviewed every PR.

Similar in shape to Figma’s vulnerability agents and Shopify’s Dispatch, and the three agree on the thing that matters: a finding nobody can demonstrate is not a finding. Ramp’s version of that is the validator’s reproducing test.