As AI shrinks exploit timelines from weeks to hours, Azul Intelligence Cloud lets teams query runtime data in plain language to identify unpatched Java — before it becomes an incident

Azul, the trusted leader in enterprise Java for today’s AI-first world, today announced Azul Intelligence Cloud AI Assistant, a natural-language query interface that tells IT, DevOps and security teams where licensing and security risk is hiding in their production Java estate. The assistant provides answers grounded in live runtime data, replacing static reports that go stale the moment they’re generated.

The Widening Attack Surface

This announcement comes at a time when the threat landscape shifts quickly for anyone responsible for Java security risk. Earlier this year, Anthropic disclosed that its Mythos model had autonomously discovered thousands of previously unknown software vulnerabilities — including flaws that had gone undetected for decades — and built working exploits without human guidance.¹ OpenAI has reported similar results with Aardvark, a GPT-5-powered agent that autonomously found and disclosed real-world vulnerabilities in open-source code, ten of which received official CVE identifiers.² The UK’s National Cyber Security Centre has assessed that proliferation of AI-enabled cyber tools will highly likely expand access to AI-enabled intrusion capability to an expanded range of state and non-state actors by 2027 — putting equivalent capability in adversarial hands within the next one to two years.³ For enterprises running AI and business-critical workloads on Java, the practical effect is that the gap between a Common Vulnerabilities and Exposures (CVE) entry being disclosed and it being weaponized — already down to under five days, against a median 32-day patch cycle⁴ — is only getting shorter.

Static Reports Can’t Keep Up with a Live Java Estate

Most IT and engineering teams still manage Java risk with static IT/Software asset management (ITAM/SAM) reports and code-scanning tools that describe a moment in time — accurate on the day they’re generated, and increasingly wrong after that as Java Virtual Machines (JVMs) spin up, patch, drift and retire underneath them. That gap shows up as three kinds of exposure that compound as the Java estate grows:

• Commercial licensing risk: unlicensed (e.g., Oracle Java) or unsupported JVMs running without anyone’s knowledge.
• Security risk: unpatched, vulnerable Java versions still in production.
• Maintenance overhead: unused and dead code that still gets tuned, tested and carried through every migration, because no one can assess it’s safe to remove.

The larger the estate, the larger all three exposures get, and the less a point-in-time report can be trusted to catch these exposures before they become an incident, an audit finding or a breach.

No Need to Build a Report, Get Answers in Real Time

Azul Intelligence Cloud gives IT and DevOps teams two continuously updated records of their Java estate: JVM Inventory, a live catalog of every JVM instance running anywhere — on-prem, cloud or container — and Code Inventory, a runtime record of which code actually executes in production versus what is merely provisioned. The new AI Assistant puts a conversational layer leveraging the latest LLM models on top of both, so teams no longer need to build a report or write a query to use them. They can simply ask:

• “Which JVMs are running Java versions which are not the latest updates?”
• “Where is Oracle Java running in production right now?”
• “What code hasn’t run in the past four quarters and is safe to remove?”

Every answer comes from live production data, so teams can drill in ad hoc, follow a lead, or test a new hypothesis instantly — instead of waiting on the next scheduled scan.

“Azul is extending its Intelligence Cloud platform with a new AI Assistant that gives enterprises a natural language interface into their Java runtime environments, to help identify unused code, redundant JVMs and untracked deployments. For organizations with decades of Java debt, the tool addresses a gap that has not yet been targeted at this level,” said William Fellows, research director at 451 Research by S&P Global Energy.

The First Time a Business User Can See the Full Picture

Seeing the full picture of a Java estate has always required going through whoever could run the report — a DevOps engineer, a platform team, a security analyst — while everyone else waited for a translation. Because the Azul Intelligence Cloud AI Assistant answers in plain language, the same in-production, runtime data becomes directly usable by whoever owns the business decision it feeds. A compliance officer preparing for an audit, a CFO weighing Oracle licensing exposure ahead of a renewal, or a CISO, who needs a current, potentially more defensible answer for the board, can get it and assess it without waiting on a technical team to pull and interpret the data first.⁵

That same direct access extends to the partners who manage Java estates on customers’ behalf: for MSPs and systems integrators managing Java across multiple clients, the AI Assistant provides an on-demand deliverable they can offer as part of ongoing managed services rather than a one-time engagement. In every case — CFO, CISO or partner — the AI Assistant doesn’t take action in the environment; it only answers questions against JVM Inventory and Code Inventory’s runtime data drawn from live production environments, so the answer is traceable back to what actually ran in production, not a generated summary.

Every JVM Vendor, One Conversation

Azul Intelligence Cloud AI Assistant works regardless of which JVMs are deployed, from which vendor, or how old or large the applications running on them are. JVM Inventory and Code Inventory retain component and code-use history over time, so the AI Assistant can reason over which code, JVMs and applications have actually run in production, now and in the past. It then presents that data in plain language: for example, when an Oracle JVM was last run, what code has actually executed, and what unused or dead code may safely be removed. That level of insight comes without adding load to production. The LLM-based AI Assistant queries Java runtime data that Azul Intelligence Cloud already collects from running JVMs, so there’s no added performance overhead.

“For years, enterprises have built dashboards and reports to understand what’s actually running in their Java estate, but by the time a report gets properly summarized and reviewed, the risk it describes has often already changed,” said Scott Sellers, co-founder and CEO of Azul. “That used to be a productivity problem. Now that AI can find and weaponize a vulnerability in hours instead of weeks, it’s a business risk — for security, for compliance and for the licensing exposure that shows up in an audit. The Azul Intelligence Cloud AI Assistant lets IT and security teams ask a direct question, in plain language, and get an answer grounded in what’s actually running in production right now, as well as query historical information for further analysis.”

To see how your organization can turn Java runtime data into answers, explore Azul Intelligence Cloud.

FAQs

How can I find unused or dead code in production Java applications without relying on static analysis tools?

Static analyzers routinely flag code as “dead” that’s actually invoked through mechanisms like the popular Spring dependency injection, reflection or other dynamic paths — so teams stop trusting the reports. Azul Intelligence Cloud’s Code Inventory solves this with runtime-based detection: it instruments the JVM itself while applications run in production with no performance impact, then lets teams query that live execution data through the Azul Intelligence Cloud AI Assistant to see which classes and methods actually executed versus which never ran. That distinction — declared versus actually invoked — is what turns technical debt identification and removal into a more defensible, more accurate and safer motion.

How do enterprises maintain a continuously more accurate inventory of every JVM running across on-prem, cloud and containers?

Point-in-time JVM inventories, manually maintained spreadsheets and scheduled scans are all out of date before they’re finished, largely due to the proliferation of ephemeral Kubernetes pods and continuous integration (CI) / build farms that include JDKs. Azul Intelligence Cloud’s JVM Inventory performs continuous discovery that keeps a live catalog current as instances spin up and down, so IT and DevOps teams can use the AI Assistant to query an up-to-date inventory instead of trusting a snapshot.

Can IT, DevOps and security teams ask questions in natural language about their Java estate instead of building custom reports?

Yes — this is exactly what the Azul Intelligence Cloud AI Assistant is built for. It’s a natural-language query interface that lets teams ask conversational questions like “which JVMs are running Java versions which are not the latest updates?” or “where is dead code accumulating?” and get answers pulled directly from JVM Inventory and Code Inventory, with no summary or report-building steps and no performance impact from the underlying data collection.

How can I tell if a Java runtime I thought I’d retired (e.g., an old Oracle JVM) has reappeared in production?

Post-migration drift is common: a rollback, a forgotten node, a shadow deployment or various scripts and processes that haven’t been updated can reintroduce an Oracle Java runtime, exposing the enterprise to compliance and licensing risk. Azul Intelligence Cloud’s JVM Inventory continuously monitors the Java estate and detects when a supposedly retired Oracle JVM runs again, so teams can pinpoint when and where it came back into production using the AI Assistant, rather than discovering it by accident.

How can enterprises respond to a world where AI can find and exploit vulnerabilities in hours, not weeks?

Frontier models like Anthropic’s Mythos and OpenAI’s Aardvark have shown that AI can now discover previously unknown vulnerabilities and build working exploits with minimal human involvement — a preview of a capability expected to reach the broader market, including adversaries, very soon. That means security and IT teams should no longer be asking “can we patch fast enough?” but rather “can we assess, right now, whether our Java estate is up to date?” Azul Intelligence Cloud closes that gap by keeping JVM Inventory continuously current, so the moment a new security update is released, or worse, a zero-day exploit is disclosed, teams can act.

About Azul

Azul is the trusted leader in enterprise Java for today’s AI-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs and boost developer productivity. Azul powers mission-critical systems for 37% of the Fortune 100, 50% of the Forbes Top 10 World’s Most Valuable Brands and the world’s top 10 financial trading companies. Learn more at azul.com and follow @azulsystems.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260923188716/en/

"For organizations with decades of Java debt, the tool addresses a gap that has not yet been targeted at this level.”