InterSystems AI-Assisted Security Capabilities

InterSystems maintains an ongoing, proactive program to identify and address potential security vulnerabilities in our products and cloud services. As part of this program, InterSystems incorporates AI-assisted capabilities, including capabilities embedded within established security tools, alongside established analysis methods, controlled testing, and engineering review. AI-assisted analysis enhances, but does not replace, the secure development, testing, and verification practices described in the InterSystems Secure Development Lifecycle.

Security Analysis

InterSystems uses AI-enabled capabilities to increase the breadth, depth, and efficiency of security testing across source code, generated or compiled product artifacts, shared libraries and components, third-party dependencies, and cloud configurations. These capabilities can help identify patterns and relationships that may be difficult to capture through deterministic rules alone, correlate product context across related code, generate targeted tests, and support the evaluation of potential corrections.

Depending on the product component and the security risks being assessed, these capabilities may be applied to both existing product code and new or modified code. Existing code may also be reassessed when new analysis capabilities, vulnerability classes, threat intelligence, or root-cause information become available.

Triage, Validation, and Root Cause

Material results that indicate a plausible vulnerability are triaged to determine, as applicable:

Affected products, components, versions, and configurations
Whether the relevant behavior is reachable
Required privileges, features, data states, or environmental conditions
Whether an attacker can influence the relevant input or operation
Potential security impact or severity

InterSystems uses AI-enabled capabilities together with controlled testing to reproduce potential vulnerabilities whenever technically practicable. Reproduction helps distinguish a plausible analysis result from observable product behavior and provides a repeatable test against which corrections and mitigations can be evaluated. It may also support the development of indicators of compromise, logging guidance, or other recommendations for detecting possible exploitation.

For issues that warrant further investigation, InterSystems determines the likely underlying root cause whenever technically practicable and evaluates whether the same condition may exist in related code paths, interfaces, shared libraries, or downstream components. Validated findings may also be used to refine analysis rules, search for related issues, and create reusable validation and regression tests.

A model-generated explanation, confidence score, proof of concept, or proposed correction is not, by itself, sufficient to confirm a vulnerability or approve a product change.

Correction Development and Validation

AI-enabled capabilities may assist InterSystems engineers in identifying related code, generating test cases, evaluating possible correction strategies, and identifying potential functional or operational effects. AI-generated corrections are treated as candidate changes and remain subject to human review. Before a correction is accepted, InterSystems engineers validate that it addresses the reproduced issue and, evaluates the correction for potential security, functional, compatibility, and operational effects, including whether it:

Addresses the identified root cause and related variants
Preserves intended product behavior and compatibility with supported interfaces and integrations
Preserves shared-library and downstream component behavior
Is tested for new security or quality issue
Is evaluated for unacceptable effects on performance, stability, availability, concurrency, or scalability
Supports a reliable installation or upgrade experience

Where a correction requires changes to supported behavior, compatibility, or functionality, those tradeoffs are reviewed through established product management, engineering, quality, and release processes. InterSystems security, quality engineering, and software engineering personnel are responsible for vulnerability disposition, correction approval, and release decisions.

Corrections, Mitigations, and Customer Guidance

Potential vulnerabilities identified through AI-enabled capabilities enter the same vulnerability-handling process as issues identified through other internal or external sources. Critical vulnerabilities, vulnerabilities subject to active exploitation, externally reported issues presenting an immediate material risk, and other urgent security issues are prioritized.

Validated security issues are addressed according to their severity, exploitability, and potential customer impact, with corrections targeted for the next available monthly maintenance release in the current Extended Maintenance (EM) release stream after completing the required engineering and quality validation. InterSystems continuously reevaluates its release processes and cadence to support the timely and effective delivery of corrections, including security-related corrections. Critical vulnerabilities and issues presenting an immediate material risk are handled on an accelerated basis when necessary rather than waiting for the normal release cadence.

InterSystems develops and validates security corrections with the objective of minimizing disruption to customer environments, including preserving backward compatibility, documented product behavior, supported integrations, data integrity, stability, performance, scalability, and reliable installation and upgrade processes.

Where an immediate correction is not available or cannot be promptly adopted, InterSystems evaluates whether validated mitigations can reduce customer risk. Where technically meaningful and supported by available evidence, InterSystems also evaluates whether indicators of compromise, relevant log or audit events, or monitoring guidance can be provided through InterSystems security alerts and related customer communications.

Correction delivery, supported-release coverage, mitigation guidance, security notices, and customer communications are governed by the InterSystems Vulnerability Handling Policy and the applicable Minimum Supported Version statement.

Customer Data and Environments

AI-enabled security analysis is performed using InterSystems-controlled product code, product artifacts, test data, and authorized test environments. References to AI-enabled database or data-platform scanning mean analysis of InterSystems product technology. They do not mean that InterSystems scans customer database contents without explicit authorization.