Azul AI Assistant helps teams find Java licensing and security risks

Azul has announced Azul Intelligence Cloud AI Assistant, a natural-language query interface that tells IT, DevOps and security teams where licensing and security risk is hiding in their production Java estate.

The assistant provides answers grounded in live runtime data, replacing static reports that go stale the moment they’re generated.

The widening attack surface

This announcement comes at a time when the threat landscape shifts quickly for anyone responsible for Java security risk. Earlier this year, Anthropic disclosed that its Mythos model had autonomously discovered thousands of previously unknown software vulnerabilities, including flaws that had gone undetected for decades, and built working exploits without human guidance.

OpenAI has reported similar results with Aardvark, a GPT-5-powered agent that autonomously found and disclosed real-world vulnerabilities in open-source code, ten of which received official CVE identifiers.

The UK’s National Cyber Security Centre has assessed that proliferation of AI-enabled cyber tools will highly likely expand access to AI-enabled intrusion capability to an expanded range of state and non-state actors by 2027, putting equivalent capability in adversarial hands within the next one to two years.

For enterprises running AI and business-critical workloads on Java, the practical effect is that the gap between a Common Vulnerabilities and Exposures (CVE) entry being disclosed and it being weaponized, already down to under five days, against a median 32-day patch cycle4, is only getting shorter.

Static reports can’t keep up with a live Java estate

Most IT and engineering teams still manage Java risk with static IT/Software asset management (ITAM/SAM) reports and code-scanning tools that describe a moment in time, accurate on the day they’re generated, and increasingly wrong after that as Java Virtual Machines (JVMs) spin up, patch, drift and retire underneath them. That gap shows up as three kinds of exposure that compound as the Java estate grows:

• Commercial licensing risk: unlicensed (e.g., Oracle Java) or unsupported JVMs running without anyone’s knowledge.
• Security risk: unpatched, vulnerable Java versions still in production.
• Maintenance overhead: unused and dead code that still gets tuned, tested and carried through every migration, because no one can assess it’s safe to remove.

The larger the estate, the larger all three exposures get, and the less a point-in-time report can be trusted to catch these exposures before they become an incident, an audit finding or a breach.

No need to build a report, get answers in real time

Azul Intelligence Cloud gives IT and DevOps teams two continuously updated records of their Java estate: JVM Inventory, a live catalog of every JVM instance running anywhere, on-prem, cloud or container, and Code Inventory, a runtime record of which code actually executes in production versus what is merely provisioned.

The new AI Assistant puts a conversational layer leveraging the latest LLM models on top of both, so teams no longer need to build a report or write a query to use them. They can simply ask:

• “Which JVMs are running Java versions which are not the latest updates?”
• “Where is Oracle Java running in production right now?”
• “What code hasn’t run in the past four quarters and is safe to remove?”

Every answer comes from live production data, so teams can drill in ad hoc, follow a lead, or test a new hypothesis instantly — instead of waiting on the next scheduled scan.

“Azul is extending its Intelligence Cloud platform with a new AI Assistant that gives enterprises a natural language interface into their Java runtime environments, to help identify unused code, redundant JVMs and untracked deployments. For organizations with decades of Java debt, the tool addresses a gap that has not yet been targeted at this level,” said William Fellows, research director at 451 Research by S&P Global Energy.

The first time a business user can see the full picture

Seeing the full picture of a Java estate has always required going through whoever could run the report, a DevOps engineer, a platform team, a security analyst, while everyone else waited for a translation.

Because the Azul Intelligence Cloud AI Assistant answers in plain language, the same in-production, runtime data becomes directly usable by whoever owns the business decision it feeds. A compliance officer preparing for an audit, a CFO weighing Oracle licensing exposure ahead of a renewal, or a CISO, who needs a current, potentially more defensible answer for the board, can get it and assess it without waiting on a technical team to pull and interpret the data first.

That same direct access extends to the partners who manage Java estates on customers’ behalf: for MSPs and systems integrators managing Java across multiple clients, the AI Assistant provides an on-demand deliverable they can offer as part of ongoing managed services rather than a one-time engagement.

In every case, CFO, CISO or partner, the AI Assistant doesn’t take action in the environment; it only answers questions against JVM Inventory and Code Inventory’s runtime data drawn from live production environments, so the answer is traceable back to what actually ran in production, not a generated summary.

Every JVM Vendor, One Conversation

Azul Intelligence Cloud AI Assistant works regardless of which JVMs are deployed, from which vendor, or how old or large the applications running on them are. JVM Inventory and Code Inventory retain component and code-use history over time, so the AI Assistant can reason over which code, JVMs and applications have actually run in production, now and in the past. It then presents that data in plain language: for example, when an Oracle JVM was last run, what code has actually executed, and what unused or dead code may safely be removed.

That level of insight comes without adding load to production. The LLM-based AI Assistant queries Java runtime data that Azul Intelligence Cloud already collects from running JVMs, so there’s no added performance overhead.

“For years, enterprises have built dashboards and reports to understand what’s actually running in their Java estate, but by the time a report gets properly summarized and reviewed, the risk it describes has often already changed,” said Scott Sellers, CEO of Azul.

“That used to be a productivity problem. Now that AI can find and weaponize a vulnerability in hours instead of weeks, it’s a business risk — for security, for compliance and for the licensing exposure that shows up in an audit. The Azul Intelligence Cloud AI Assistant lets IT and security teams ask a direct question, in plain language, and get an answer grounded in what’s actually running in production right now, as well as query historical information for further analysis,” Sellers concluded.