Securing Software at the Speed of AI

Summary

Palantir describes how its Product Security Team built an agentic software security strategy around multi-agent review, vulnerability hunting, triage, and runtime validation. The approach treats models as replaceable components within a governed harness that controls tools and data access, preserves evidence, coordinates specialized stages, independently challenges findings, and deduplicates reports using source-to-sink paths. Foundry supplies organizational context and lineage across code, services, findings, decisions, and remediation, while Apollo provides a controlled path for delivering verified fixes across heterogeneous software environments. The strategy positions remediation, rather than vulnerability identification, as the central bottleneck and extends these capabilities through Security Forge, a model-agnostic platform for customer cyber defense.

Takeaways

1. 1

   A model alone is not a security-review program; the harness must scope agent access, preserve evidence, coordinate stages, independently challenge findings, and route validated results to engineers.

2. 2

   Deterministic deduplication compares source-to-sink paths in addition to semantic similarity, helping distinguish repeated reports of one root cause from distinct vulnerabilities.

3. 3

   Security Forge combines cyber-tuned models, organizational context, remediation recommendations, and automated deployment to reduce analyst burden and accelerate containment while preserving human judgment at important decisions.