Azul, the trusted leader in enterprise Java for today’s AI-first world, has announced the launch of the Azul Intelligence Cloud AI Assistant, a natural-language interface designed to help IT, DevOps and security teams identify licensing and security risks across their production Java environments.
The AI Assistant provides answers based on live runtime data, enabling organizations to identify issues such as unpatched Java versions and licensing exposure without relying solely on static reports that can quickly become outdated.
The Widening Attack Surface
The announcement comes as organizations face an increasingly compressed window between vulnerability discovery and exploitation. Earlier this year, Anthropic reported that its Mythos model had autonomously identified thousands of previously unknown software vulnerabilities, including flaws that had remained undetected for decades, and developed working exploits without human guidance.
OpenAI has reported similar findings involving Aardvark, a GPT-5-powered agent that autonomously identified and disclosed vulnerabilities in real-world open-source code, with ten receiving official CVE identifiers.
The UK’s National Cyber Security Centre has also assessed that the proliferation of AI-enabled cyber tools will highly likely expand access to AI-enabled intrusion capabilities among a broader range of state and non-state actors by 2027.
For enterprises running AI and business-critical workloads on Java, this creates an increasingly urgent security challenge. The period between a Common Vulnerabilities and Exposures (CVE) disclosure and weaponization has already fallen to less than five days, compared with a median 32-day patch cycle.
Static Reports Struggle to Keep Pace With Live Java Environments
Many IT and engineering teams continue to depend on static IT/Software asset management (ITAM/SAM) reports and code-scanning tools to assess Java environments. While these reports may accurately represent the environment when generated, their visibility can deteriorate as Java Virtual Machines (JVMs) are deployed, patched, modified and retired.
As Java estates expand, organizations can face three overlapping areas of exposure:
- Commercial licensing risk: Unlicensed, including Oracle Java, or unsupported JVMs may be operating without the organization’s knowledge.
- Security risk: Vulnerable or unpatched Java versions may remain active in production.
- Maintenance overhead: Unused or dead code may continue to be maintained, tested and carried through migrations because teams lack sufficient runtime visibility to determine whether it can safely be removed.
The scale of these risks increases with the size of the Java estate, while point-in-time reporting becomes less reliable for identifying exposures before they result in an incident, audit finding or breach.
Real-Time Answers Without Building Custom Reports
Azul Intelligence Cloud provides IT and DevOps teams with two continuously updated views of their Java estate. JVM Inventory provides a live catalog of JVM instances running across on-premises environments, cloud infrastructure and containers. Code Inventory provides runtime visibility into the code actually executing in production compared with code that is simply provisioned.
The new AI Assistant adds a conversational interface powered by the latest LLM models, allowing teams to query this information using natural language rather than building reports or writing custom queries.
For example, teams can ask questions such as:
- Which JVMs are running Java versions that are not the latest updates?
- Where is Oracle Java currently running in production?
- What code has not run during the past four quarters and may be safe to remove?
Because responses are based on live production data, teams can investigate issues, follow leads and test hypotheses in real time rather than waiting for a scheduled scan.
“Azul is extending its Intelligence Cloud platform with a new AI Assistant that gives enterprises a natural language interface into their Java runtime environments, to help identify unused code, redundant JVMs and untracked deployments. For organizations with decades of Java debt, the tool addresses a gap that has not yet been targeted at this level,” said William Fellows, research director at 451 Research by S&P Global Energy.
Giving Business Teams Direct Visibility Into the Java Estate
Historically, obtaining a complete view of a Java estate has often required technical teams such as DevOps engineers, platform teams or security analysts to generate and interpret reports for other stakeholders.
The Azul Intelligence Cloud AI Assistant makes the same production runtime data accessible through natural-language queries. This allows business stakeholders to obtain information relevant to their responsibilities without first depending on a technical team to produce and interpret a report.
For example, compliance officers can use the information when preparing for an audit, CFOs can examine potential Oracle licensing exposure ahead of a renewal, and CISOs can access current information for security and board-level discussions.
The capability also extends to managed service providers (MSPs) and systems integrators responsible for Java environments across multiple customers. These organizations can use the AI Assistant to provide on-demand visibility as part of ongoing managed services rather than relying exclusively on one-time engagements.
The AI Assistant does not take action within the environment. Instead, it answers questions using runtime data from JVM Inventory and Code Inventory collected from live production environments. This allows responses to be traced back to actual production activity rather than relying on a generated summary.
One Conversation Across JVM Vendors
Azul Intelligence Cloud AI Assistant is designed to work across JVM deployments regardless of vendor, application age or environment size.
JVM Inventory and Code Inventory maintain historical information about components and code usage, allowing the AI Assistant to analyze which code, JVMs and applications have actually operated in production both currently and historically.
The resulting information can be presented in natural language, including details such as when an Oracle JVM last ran, which code has actually executed and which unused or dead code may be suitable for removal.
The analysis does not introduce additional load to production environments. The LLM-based AI Assistant queries Java runtime data that Azul Intelligence Cloud already collects from running JVMs, without adding performance overhead.
“For years, enterprises have built dashboards and reports to understand what’s actually running in their Java estate, but by the time a report gets properly summarized and reviewed, the risk it describes has often already changed,” said Scott Sellers, co-founder and CEO of Azul. “That used to be a productivity problem. Now that AI can find and weaponize a vulnerability in hours instead of weeks, it’s a business risk — for security, for compliance and for the licensing exposure that shows up in an audit. The Azul Intelligence Cloud AI Assistant lets IT and security teams ask a direct question, in plain language, and get an answer grounded in what’s actually running in production right now, as well as query historical information for further analysis.”
To learn more about turning Java runtime data into actionable answers, organizations can explore Azul Intelligence Cloud.
FAQs
How can I identify unused or dead code in production Java applications without depending on static analysis tools?
Static analyzers can identify code as “dead” even when it is invoked through mechanisms such as Spring dependency injection, reflection or other dynamic execution paths. This can make teams less confident in static reports.
Azul Intelligence Cloud’s Code Inventory instead uses runtime-based detection. It instruments the JVM while applications are running in production without performance impact and allows teams to query live execution data through the Azul Intelligence Cloud AI Assistant. This provides visibility into which classes and methods have actually executed and which have not.
The distinction between declared code and code that is actually invoked can provide a more accurate basis for identifying and removing technical debt.
How can enterprises maintain an accurate inventory of JVMs across on-premises environments, cloud infrastructure and containers?
Point-in-time inventories, manually maintained spreadsheets and scheduled scans can become outdated quickly, particularly as organizations adopt ephemeral Kubernetes pods and continuous integration (CI) and build environments containing JDKs.
Azul Intelligence Cloud’s JVM Inventory continuously discovers JVM instances and maintains a live catalog as instances are deployed and removed. IT and DevOps teams can therefore use the AI Assistant to query current inventory information rather than relying on a static snapshot.
Can IT, DevOps and security teams use natural language to query their Java estate?
Yes. The Azul Intelligence Cloud AI Assistant is designed to provide a natural-language query interface for Java environments.
Teams can ask conversational questions about their Java estate, including which JVMs are running outdated Java versions or where unused code is accumulating. The answers are drawn directly from JVM Inventory and Code Inventory without requiring teams to build custom reports or summaries, and the underlying data collection does not introduce performance impact.
How can organizations determine whether a Java runtime they previously retired has returned to production?
Post-migration drift can occur through rollbacks, forgotten nodes, shadow deployments, scripts or other processes that have not been updated. These situations can reintroduce an Oracle Java runtime and create compliance and licensing exposure.
Azul Intelligence Cloud’s JVM Inventory continuously monitors the Java estate and can detect when a previously retired Oracle JVM becomes active again. Teams can then use the AI Assistant to identify when and where the runtime returned to production.
How can enterprises respond to a threat landscape where AI can discover and exploit vulnerabilities within hours?
Frontier models such as Anthropic’s Mythos and OpenAI’s Aardvark have demonstrated capabilities for identifying previously unknown vulnerabilities and developing working exploits with limited human involvement. These developments indicate that such capabilities could become more broadly accessible, including to adversaries.
As a result, organizations need timely visibility into the security state of their Java environments. Azul Intelligence Cloud maintains JVM Inventory continuously, allowing teams to assess their Java estate when new security updates become available and respond when vulnerabilities, including zero-day exploits, are disclosed.
________
About Azul
Azul is the trusted leader in enterprise Java for today’s AI-first world. Its open source-based Java platform empowers organizations to optimize the entire Java lifecycle to accelerate performance, strengthen security, reduce licensing and cloud costs and boost developer productivity. Azul powers mission-critical systems for 37% of the Fortune 100, 50% of the Forbes Top 10 World’s Most Valuable Brands and the world’s top 10 financial trading companies. Learn more at azul.com and follow @azulsystems.
________
Media Contact:
Treble
Josh Georgiou
azul@treblepr.com
Join our LinkedIn group Information Security Community!
