The Security Bottleneck Nobody Talks About
Here's a conversation I had with a security engineer last month:
"We find maybe 5-10 vulnerabilities per week. Sounds good? Wait for it..."
"It takes 4+ hours per vulnerability just to analyze the impact. Which services? Which teams? What's the real risk? Then we write the fix, create the MR, get reviews..."
"By the time we're done, it's been 2 weeks. Vulnerabilities pile up."
This is the story at EVERY organization.
According to industry research, 40% of identified vulnerabilities remain unfixed—not because teams don't care, but because the analysis is paralyzingly slow.
I decided to fix this with AI.
The Problem: Manual Vulnerability Analysis is Broken
Let's break down what security teams actually do with each finding:
Hour 1: Dependency Tracing
"Which services call this vulnerable code?"
Teams manually check:
- Code imports
- Function calls
- Service dependencies
- Cross-repo usage
It's tedious. It's error-prone. It's slow.
Hour 2: Impact Assessment
"How many services are affected?"
Teams need to understand:
- Direct dependencies
- Indirect dependencies (dependencies of dependencies)
- Remote dependencies (3+ hops away)
Most teams give up and guess.
Hour 3: Owner Identification
"Who owns this code?"
Finding the right owner requires:
- Searching CODEOWNERS files
- Checking team docs
- Slack conversations
- Sometimes physical conversations
Hour 4+: Fix Generation
"How do we write secure code?"
For each language, patterns differ:
- Python: Use parameterized queries
- JavaScript: Use prepared statements
- Go: Use database/sql patterns
- Java: Use PreparedStatement
- C#: Use parameterized commands
Teams usually have one expert. That expert gets bottlenecked.
Total: 4+ hours per vulnerability.
For a $150K security engineer, that's $150,000+ in pure analysis overhead per year per team.
The Insight: This Can Be Automated
Three technologies converge here:
- GitLab Duo Agent - Orchestrates workflow
- Orbit Knowledge Graph - Knows code dependencies
- Claude AI - Writes secure code
Combined, they can replace 4+ hours with 45 seconds.
Introducing Orbit Tracer Security Agent
We built Orbit Tracer Security Agent, a GitLab Duo Agent that automates the entire vulnerability remediation workflow.
Here's how it works:
Step 1: Vulnerability Detection (Automatic)
GitLab SAST finds: SQL Injection in database/user_service.py
Step 2: Blast Radius Analysis (Automatic via Orbit)
Agent queries Orbit knowledge graph:
- What calls database/user_service.py?
- payment_service.py (direct)
- user_api.py (direct)
- web_app.js (indirect, calls user_api)
- mobile_app.js (indirect, calls user_api)
Result: 4 services affected, 12 files impacted
Step 3: Risk Scoring (Automatic via Claude)
Algorithm: Severity × Impact × Exploitability + Compliance
- Severity: 10 (SQL Injection)
- Impact: 10 (affects 4 services)
- Exploitability: 9 (trivial to exploit)
- Compliance: +3 (PCI-DSS violation)
Risk Score: 9/10 (CRITICAL)
Step 4: Owner Identification (Automatic via Orbit)
Agent checks CODEOWNERS:
- Primary: @database-team
- Secondary: @platform-team, @security-team
Notifies: All 3 teams
Step 5: Secure Code Generation (Automatic via Claude)
Agent detects: Python
Generates fix:
def get_user(user_id):
cursor.execute('SELECT * FROM users WHERE id = ?', (user_id,))
return cursor.fetchone()
Step 6: Human Approval (Optional)
For CRITICAL findings: Requires review
For HIGH findings: Requires review
For MEDIUM/LOW: Auto-approves
MR created with full context.
Total time: 45 seconds. Compared to 4+ hours: 99.8% faster.
The Numbers
Time per vulnerability: 4+ hours → Minutes
Speedup: 100x - 320x faster
Time saved per team: 40+ hours/month
Annual value per team: $20,000+
Languages supported: 7+ (Python, JS, Go, Java, C#, C++, Rust)
Vulnerability types: 10 (OWASP Top 10)
Risk accuracy: Multi-factor, not just CVSS
Technical Highlights
Multi-Factor Risk Scoring
Instead of CVSS alone, we calculate:
Risk Score = (Severity × Impact × Exploitability) / 10 + Compliance Bonus
Where:
- Severity: 1-10 (CVSS mapping)
- Impact: 1-10 (services affected × data type)
- Exploitability: 1-10 (attack surface × auth requirements)
- Compliance: 0-3 (GDPR, PCI-DSS, HIPAA)
This produces nuanced scores:
- SQL Injection in payment system: 10/10
- SQL Injection in read-only analytics: 5/10
Same vulnerability, wildly different risk.
Language-Agnostic Remediation
We separate concepts from implementations:
- Vulnerability class (SQL Injection)
- Remediation pattern (Parameterized queries)
- Language binding (How Python does parameterized queries)
HITL (Human-in-the-Loop)
We don't believe in full automation:
LOW/MEDIUM: Auto-approve → Auto-merge
HIGH: Require review → Human approval → Merge
CRITICAL: Require review → Require security review → Merge
This gives teams both speed AND safety.
Why This Matters
This is built during the GitLab Transcend Hackathon and demonstrates:
- Duo Agent Potential - AI agents solve real problems
- Orbit Value - Knowledge graph enables enterprise features
- Developer Experience - Security can be fast AND safe
- Market Opportunity - 40% of vulnerabilities go unfixed
What's Next
Phase 1 is complete. Future roadmap:
- Phase 2: Real-time vulnerability tracking dashboard
- Phase 3: Automated scheduled remediation
- Phase 4: Multi-organization enterprise features
- Phase 5: Open source ecosystem and SaaS platform
Try It Out
The project is open source and production-ready. You can explore the complete implementation, test cases, and interactive agent on GitLab.
Project URL:
https://gitlab.com/rajus-agent/orbit-tracer
Primary Agent:
Orbit Tracer Security Agent
https://gitlab.com/explore/ai-catalog/agents/1011797/
Feedback Welcome
I'd love to hear your thoughts:
- Security teams: Would this solve your pain points?
- DevOps engineers: How would you integrate this?
- Developers: Interested in contributing?
Let's make security velocity the default. 🚀
