AI speeds software flaw discovery, but hardware security still needs experts, PQShield VP says

The executive explained that modern software codebases are sprawling ecosystems of interconnected modules, third-party dependencies, legacy components, and undocumented assumptions. Security flaws often emerge from subtle interactions between components separated by hundreds of files or years of development history. While human reviewers are constrained by time and cognitive bandwidth, AI systems can rapidly traverse large amounts of code, correlate information across repositories, and identify patterns associated with known vulnerability classes.

This capability is especially powerful for common software weaknesses such as memory-safety issues, race conditions, authentication flaws, insecure API usage, and privilege-escalation paths. In many cases, AI is amplifying established security techniques rather than inventing new ones. The result, according to the article, is that vulnerabilities that previously required substantial manual effort can now be discovered at a much greater scale and speed.

The falling cost of vulnerability discovery has profound implications for product security. Organizations can no longer assume that obscure vulnerabilities will remain undiscovered because finding them is too expensive. Security testing is shifting from point-in-time assessment to continuous assurance throughout the development lifecycle.

However, the article argues that AI will not transform all areas of cybersecurity equally. Hardware security, particularly side-channel analysis of cryptographic implementations, presents a fundamentally different challenge. Cryptographic implementations operate within a narrow, mathematically defined problem space. Side-channel attacks target subtle information leakage through physical phenomena such as execution timing, power consumption, or electromagnetic emissions. The challenge is not understanding millions of lines of source code but extracting meaningful signals from carefully collected measurements and applying sophisticated statistical techniques.

The strengths that make large language models effective in software security, such as connecting information across large bodies of text and code, are less relevant in side-channel research, which already relies heavily on structured datasets, statistical processing, signal analysis, and deep domain expertise. AI can accelerate parts of the workflow, from automating experimentation to assisting with data interpretation, but the advantage is typically more incremental than transformational.

The broader lesson, the executive wrote, is that security testing is becoming more important, not less. AI increases the speed of vulnerability discovery but does not eliminate the need for expert analysis. Organizations that combine AI-assisted testing with rigorous human-led security evaluation will be best positioned to address the evolving threat landscape, whether the target is a cloud application, an embedded device, or the cryptographic hardware that underpins digital trust.