On Wednesday, Azul unveiled its Azul Intelligence Cloud AI Assistant, a natural-language interface designed to help engineering teams identify security vulnerabilities and licensing violations within their active Java production environments. The tool addresses a critical gap in how enterprises currently manage Java risk: by providing answers grounded in live runtime data rather than relying on snapshots that become obsolete within hours.

The assistant replaces the traditional approach of static IT and software asset management reports, along with code-scanning tools that capture only a single moment in time. According to Azul, most IT and engineering teams still depend on these point-in-time assessments, which the company characterizes as "accurate on the day they're generated, and increasingly wrong after that." The problem stems from Java Virtual Machines being continuously spun up, patched, drifted and decommissioned beneath the scope of these reports.

The accelerating threat landscape

Scott Sellers, co-founder and CEO of Azul, explained the urgency: "For years, enterprises have built dashboards and reports to understand what's actually running in their Java estate, but by the time a report gets properly summarized and reviewed, the risk it describes has often already changed. That used to be a productivity problem. Now that AI can find and weaponize a vulnerability in hours instead of weeks, it's a business risk – for security, for compliance and for the licensing exposure that shows up in an audit."

Azul cited research suggesting that the window between vulnerability disclosure and exploitation has contracted dramatically. An April 2026 Cloud Security Alliance white paper (marked as unofficial AI-assisted research) noted that while organizations historically required a median of 32 days to patch known vulnerabilities, the median time-to-exploit has collapsed to approximately 5 days in 2025. The company referenced AI models such as Anthropic's Mythos and OpenAI's Aardvark, which have autonomously discovered real-world vulnerabilities.

How the assistant works

The Azul Intelligence Cloud AI Assistant operates on top of two continuously updated inventories. JVM Inventory provides a live catalog of every JVM instance running anywhere—whether on-premises, in the cloud or in containers. Code Inventory maintains a runtime record of which code actually executes in production versus what is merely provisioned. The conversational layer uses LLM models to allow engineers to query this data in plain language.

Engineers can pose questions such as:

  • Which JVMs are running Java versions which are not the latest updates?
  • Where is Oracle Java running in production right now?
  • What code hasn't run in the past four quarters and is safe to remove?

Azul noted that post-migration JVM drift is common, often resulting from rollbacks, forgotten nodes, shadow deployments or scripts and processes that haven't been updated. Such drift can reintroduce an Oracle Java runtime, creating compliance, licensing and security risks.

Competitive landscape and industry perspective

The Java runtime analytics and security market includes several established vendors. Contrast Security is recognized for its JVM agent and in-app bytecode instrumentation. Dynatrace offers Runtime Vulnerability Analytics as part of its observability platform, which includes OneAgent monitoring for Java vulnerable functions and JVM-level bytecode instrumentation agents. Fortify, now part of OpenText following acquisitions by HP and Micro Focus, provides static and dynamic application testing services, including Fortify Application Defender, a runtime application self-protection agent for Java workloads. Imperva, owned by Thales, delivers runtime security for Java and .NET applications spanning access control to anomaly detection, though it has reportedly discontinued its standalone RASP product. Datadog rounds out the field with Application Performance Monitoring capabilities for code-level distributed tracing.

Andrew Krug, head of security advocacy at Datadog, told The New Stack that the primary limitation of point-in-time inventory scans is that they are "not always representative" of the runtime environment. "Runtime context is absolutely critical for understanding the real risk in the production environment," Krug says. "Even in the most mature software development lifecycle flows, tooling that generates static software bill of materials may be bypassable to get a feature deployed. Moreover, traditional vulnerability management flows outside of CI/CD process can bump versions outside of CI/CD process, accidentally compounding the problem and introducing added risk by bypassing known good guardrails like dependency cooldowns."

Krug also noted that Datadog observes "an increasing rise" in automated drive-by attacks targeting known vulnerabilities, particularly Java. "Attacks used to be added to scanners, either specifically or generically, and scans are indiscriminately against targets," Krug explains. "LLMs make it cheaper to add support for new vulnerabilities. However, it also makes it easier for individual researchers/hackers to have their own custom rulesets." This development makes threat trends harder to predict than traditional scanner updates, as attackers increasingly focus on lateral movement, persistence and credential harvesting.

The dead code problem

The presence of multiple competitors in this space reflects genuine commercial and security risks stemming from orphaned Java code, redundant JVMs and untracked Java components. Azul emphasized that unused and dead code often continues to be tuned, tested and migrated forward simply because teams cannot confidently assess whether removal is safe. As Java estates grow larger, so do the potential exposures, and the reliability of point-in-time reports in catching these issues before they become incidents, audit findings or breaches diminishes accordingly.

Compliance officers are likely to benefit from wider adoption of these tools, though such roles may now reside within DevSecOps or platform engineering teams. The Azul Intelligence Cloud AI Assistant functions regardless of which JVMs are deployed, their vendor origin or age, or the size of applications running on them. JVM Inventory and Code Inventory preserve component and code-use history over time, enabling the AI Assistant to reason about which code, JVMs and applications have actually run in production, both currently and historically.