Enterprise Java company Azul announced its Azul Intelligence Cloud AI Assistant on Wednesday, a natural-language query interface designed to help software engineering teams identify security vulnerabilities and licensing violations within their live production Java environments. The tool responds to industry-wide warnings that artificial intelligence has become a force multiplier for threat actors, according to the announcement. Unlike static reports that describe a snapshot in time, the assistant delivers answers grounded in live runtime data, addressing the problem that traditional code-scanning tools grow less accurate as Java Virtual Machines are spun up, patched, drifted, and retired beneath the report's scope.

The gap between a vulnerability being disclosed and weaponized is shrinking rapidly, Azul said. The company cited an April 2026 Cloud Security Alliance white paper suggesting that while organizations historically took a median of 32 days to apply patches to known vulnerabilities—a window that roughly matched the time before exploitation began—that window has collapsed to approximately five days for median time-to-exploit in 2025. Azul pointed to AI models such as Anthropic's Mythos and OpenAI's Aardvark, which have autonomously discovered real-world vulnerabilities, as evidence that the weaponization gap is closing. The company's Intelligence Cloud service provides two continuously updated records: JVM Inventory, a live catalog of every JVM instance running anywhere, and Code Inventory, a runtime record of which code actually executes in production versus what is merely provisioned.

"For years, enterprises have built dashboards and reports to understand what's actually running in their Java estate, but by the time a report gets properly summarized and reviewed, the risk it describes has often already changed," said Scott Sellers, co-founder and CEO of Azul. "Now that AI can find and weaponize a vulnerability in hours instead of weeks, it's a business risk." The company explained that most IT and engineering teams still manage Java risk with static IT and software asset management reports and code-scanning tools that are accurate on the day they're generated and increasingly wrong after that. Software engineers can now ask questions such as "Which JVMs are running Java versions which are not the latest updates?" or "Where is Oracle Java running in production right now?" and receive answers based on what's actually running at that moment.

The shift from weeks to hours in exploit development fundamentally changes how enterprises must approach Java security, according to the announcement. Head of security advocacy at Datadog, Andrew Krug, told The New Stack that runtime context is "absolutely critical for understanding the real risk in the production environment," noting that even in the most mature software development lifecycle flows, tooling that generates static software bill of materials may be bypassable to get a feature deployed. Krug added that Datadog now sees an increasing rise in automated drive-by attacks on known vulnerabilities, particularly Java in many cases, because LLMs make it cheaper to add support for new vulnerabilities. The problem is compounded by what Azul called "dead code"—unused code that still gets tuned, tested, and carried through every migration because no one can assess it's safe to remove, creating real maintenance overhead and exposing compliance and licensing risks.

The Azul Intelligence Cloud AI Assistant works regardless of which JVMs are deployed, from which vendor, or how old or large the applications running on them are, the company said. JVM Inventory and Code Inventory retain component and code-use history over time, so the AI Assistant can reason over which code, JVMs, and applications have actually run in production, now and in the past. The company noted that post-migration JVM drift is common, often due to a rollback, a forgotten node, a shadow deployment, or various scripts and processes that haven't been updated, which can reintroduce an Oracle Java runtime and expose compliance and licensing risk. Organizations that rely on point-in-time inventory scans face a growing mismatch between what their reports say and what's actually running, making real-time visibility not just a productivity improvement but a fundamental requirement for managing business risk. The implication is clear: as automation accelerates both development and exploitation, the tools that protect production environments must operate at the same speed.