Vicarius launched vRx 2.0 on October 28, 2026, a major release of its flagship platform built for a threat landscape where attackers use AI to find and exploit weaknesses faster than teams can fix them. The release delivers what the company calls True Remediation, focusing on reducing risk rather than simply closing tickets, through a single agentic pipeline that unifies vulnerability discovery, risk prioritisation, patching, patchless protection, scripting and AI-generated remediation. It also expands discovery through vRadar, adding unmanaged device detection and scanning against CIS benchmarks and compliance frameworks such as HIPAA, PCI DSS and CMMC.
Why Detection Alone No Longer Works
The premise is blunt: attackers are operating at machine speed, while remediation still depends on people, tickets and patch cycles measured in weeks. AI now accelerates both vulnerability discovery and exploit development, so better detection alone is no longer enough. Security teams need to close exposures as quickly as they are discovered, and that means AI has to do more than point to the problem.
Vicarius’ 2026 State of Vulnerability Remediation report, Exposed and Unfixed, gives the claim numbers. It found that 79% of organisations experienced a security incident in the past year involving a vulnerability they already knew about, 58% of remediation activity still requires manual work, only 7% of organisations have fully automated remediation, and 82% cannot consistently fix vulnerabilities within the team that found them. The vulnerabilities had already been found; the challenge was what happened next.
Chief executive Roi Cohen put it more sharply: once you accept that attackers have AI finding and weaponising vulnerabilities faster than any human team can track, defending with people and tickets is not a strategy, it is a delay tactic. vRx 2.0, he said, puts AI on the defender’s side, moving as fast as the AI on the attacker’s side, not as a faster tool for a person to run but as a system built to fight at the speed of the attack.
One Pipeline, Four Ways To Fix
vRx 2.0 combines discovery and remediation so teams move from identifying vulnerabilities to reducing exposure. vRadar, the company’s agentless scanner, works alongside the vRx agent to provide vulnerability and compliance scanning and deeper endpoint visibility where deployed. vScore prioritises findings based on exploitability, weaponisation status, asset criticality and business context, rather than relying on CVSS scores alone, and it reassesses risk after remediation.
The platform then offers multiple paths to address a vulnerability, depending on the situation. vPatch deploys available fixes across Windows, macOS, Linux and more than 20,000 third-party applications. vShield provides patchless protection when a patch is unavailable or cannot be deployed, blocking exploit paths at the memory level without requiring a reboot. vScript executes detection and remediation scripts from Vicarius’ library and the vSociety community.
The fourth path is ScriptAI, a proprietary generative AI engine introduced in September that generates and validates scripts in under an hour, compared with traditional processes that can take weeks, including for vulnerabilities without an official patch. AI-generated scripts remain drafts until reviewed and approved by a person before deployment to live assets, a human gate before deployment to live assets.
Compliance And Verification Built In
vRx 2.0 also includes AI grouping, which lets teams define asset groups in natural language, and vComply, which maps remediation activity to frameworks including CIS Benchmarks, PCI DSS, HIPAA and CMMC. Reporting is now AI-generated, with analysts able to shape, annotate and approve reports before they go to leadership or auditors. Integrations with existing IT service management, endpoint detection and response, security orchestration and remote monitoring tools let organisations adopt vRx without replacing their security stack.
The launch builds on a deliberate sequence: vIntelligence arrived in March 2026 as a second flagship product for continuous validation, orchestration and AI-driven security insight, with native integration into vRx for closed-loop remediation, and ScriptAI followed in September. vRx 2.0 brings discovery, prioritisation and remediation into a single workflow that verifies fixes rather than leaving vulnerabilities in a ticket queue, with vIntelligence re-checking after every fix.
That verification step is the difference between a tool that claims to remediate and one that proves it. Traditional vulnerability management often assumes one outcome, install the patch, but patches may be unavailable, too risky to deploy or insufficient to address the underlying exposure. Vicarius’ approach gives teams options, and it measures success by risk removed, not tickets closed, a metric that aligns security work with what boards actually care about.
Why It Matters
This matters because the security industry has spent years getting better at finding problems while the time to fix them stayed stubbornly human. If an agentic pipeline can genuinely close that gap, verifying each fix rather than merely logging it, it changes the economics of defence, much as agentic firewall policy and safe execution for AI agents are changing adjacent parts of the stack, and it complements continuous pen testing for smaller firms. The sceptical view is that AI-generated remediation scripts are only as trustworthy as their human approval step, and that speed without verification is a new risk, not a cure; vRx 2.0’s answer is that verification is the product, not an afterthought, and its adoption will show whether customers agree.
Background
Vicarius is a vulnerability remediation company whose vRx platform discovers assets, scores risk and carries out fixes, and it says more than 1,000 organisations in 80 countries trust it to turn findings into fixes.
Source: Vicarius announcement
0 Comments