Transformation of Vulnerability Management Through Artificial Intelligence: An Overview of Generative and Learning Models

Software teams now uncover far more vulnerabilities than they can reasonably triage or fix. At the same time, learning-based analysis and large code models have matured. They can now move beyond pattern matching and into semantic reasoning over code, binaries, dependencies, and infrastructure-as-code (IaC). This article brings these threads together. We organize the field around how models “see” software (tokens and sequences; Abstract Syntax Trees (ASTs)/Control Flow Graphs (CFGs)/Data Flow Graphs (DFGs)/Code Property Graphs (CPGs); Intermediate Representations (IRs) and bytecode; and deployment/configuration artifacts). We then compare families of detectors on both technical and operational grounds. Building on that view, we outline a risk-aware prioritization model. This model combines signals of likelihood, exposure, and impact into clear, auditable policies that reduce effort for the same level of exploited coverage. We also examine how large models can assist with scoring and remediation. Finally, we specify the guardrails-tests, static checks, and policy constraints-needed to keep generated changes reliable and traceable. The result is a practical map: where to integrate capabilities in Continuous Integration/Continuous Deployment (CI/CD), what evidence to retain for audit, and how to measure success using program metrics such as triage time, developer acceptance, and change-failure rate. The paper closes with concrete research directions in multi-modal learning, privacy-preserving training, and safe autonomy for remediation.