Sentinel

In application security, identifying a vulnerability represents only part of the overall task. A system may report a vulnerability as "fixed" without providing evidence that the underlying weakness has actually been eliminated. As a result, remediation status is often based on the assumption that a change was made, rather than confirmation that the change was effective. Sentinel is an AI-powered security testing and remediation platform built with IBM Bob 2.0. Bob 2.0 was employed both in the development of Sentinel and as its primary security agent, serving in the roles of attacker, analyst, remediator, and verifier throughout the assessment process. Sentinel addresses this problem through a closed-loop workflow consisting of four phases: Attack → Analyze → Remediate → Verify. Bob 2.0 conducts authorized security tests against a deliberately vulnerable application, analyzes the resulting findings to determine root cause, develops and applies remediation, and subsequently re-executes the original attack against the remediated system. A finding is classified as Verified only when this repeated attack no longer succeeds, rather than upon the mere application of a patch. Each finding progresses through a defined lifecycle: Vulnerable → Fixed → Verified. This process is currently demonstrated across three vulnerability classes: SQL Injection, Insecure Direct Object Reference (IDOR), and Command Injection. Sentinel extends beyond vulnerability detection and beyond remediation in isolation. By integrating discovery, remediation, and verification into a single continuous process, the platform provides substantiated evidence that a given security fix has achieved its intended effect.