Beyond CVEs: Agentic AI for Real-World Software Vulnerability Discovery and Prioritization

Software systems are increasingly built with complex configurations involving third-party libraries, cloud platforms, and continuously running deployment pipelines. These factors contribute to the continuous expansion of attack surfaces, making security a critical concern. State-of-the-art software security tools rely on predefined vulnerability identifiers, such as the Common Vulnerabilities and Exposures (CVEs), combined with static, rule-based analysis. However, such approaches are ineffective at discovering previously unknown vulnerabilities, exposed misconfigurations, and environment-dependent security issues commonly found in real-world systems. This results in suboptimal coverage, elevated false positive rates, and alert fatigue for security teams. This paper introduces an agentic artificial intelligence–centric framework for software vulnerability discovery and prioritization that operates beyond CVE-based detection. The proposed system adopts a multi-agent architecture in which specialized agents analyze proprietary and third-party source code, software dependencies, configuration artifacts, and runtime environment context. Leveraging large language models with semantic reasoning and contextual risk inference capabilities, the framework identifies security issues that lack prior classification in public vulnerability databases. Unlike traditional severity-based scoring approaches, the proposed framework prioritizes vulnerabilities based on exploit likelihood, prevalence, and operational impact. This risk-based prioritization reduces remediation effort by focusing attention on vulnerabilities that pose substantial real-world risk. Experimental evaluation on heterogeneous, production-scale software repositories demonstrates improved recall for previously unclassified vulnerabilities, along with a measurable reduction in false positives and alert fatigue when compared to conventional CVE-based scanners. These findings indicate that agentic AI represents a promising pathway for bridging academic vulnerability taxonomies with the practical security requirements of modern software supply chains.