AI, where it's actually trustworthy
A lot of security tools now say "AI-powered" without saying what that actually means. Here's exactly where AI touches Drubix, where it doesn't, and why that line is drawn on purpose — not as a limitation we're apologizing for, but as the actual reason this can be trusted with something as consequential as security findings.
Every vulnerability match in Drubix comes from real security advisories, fetched directly from drupal.org's own feed, compared against a site's real, confirmed software versions. That process is fully deterministic — the same input always produces the same finding, and there's no step in it a language model could hallucinate. AI is layered on top of that, in three specific places, to do the parts language models are genuinely good at: writing, summarizing, and correlating. It's never asked to do the part it's genuinely bad at — deciding, with certainty, whether something is a real vulnerability.
| What AI never does | What AI actually does |
|---|---|
| Decide whether a module version is vulnerable | Write the pull request description explaining a fix that was already fully determined by the real advisory data |
| Choose which version to upgrade to | The upgrade itself is the exact fixed_version published in the advisory — a plain version-bump, computed the same way every time |
| Assert that an AI agent caused a specific configuration change | Flag when AI agent activity and a real risk (a dangerous permission, real config drift) happened in the same window — always labeled as correlation, never claimed as proof |
| Invent a finding, a count, or a detail that isn't already in your data | Turn real, already-computed severity counts and the actual most urgent finding into a short paragraph a non-technical client can read |
Security tools that let a model participate in the actual detection step carry a real risk: a false positive that looks confident, or worse, a false negative — a real vulnerability a model quietly decided wasn't one. That's not a hypothetical concern; it's the reason the credible players in this space (the ones actually trusted by security teams) all draw this same boundary in their own architecture — deterministic analysis for the finding itself, generative AI layered on top only for explanation and remediation. Drubix follows that same principle, not because it's cautious marketing copy, but because it's the only version of "AI security tool" that a security-conscious buyer should actually trust.
For a confirmed finding, Drubix opens a real pull request against your repository — the exact Composer version bump the advisory specifies, already committed on a branch. AI writes the explanation in the PR description: what the finding is, why it matters, in plain language. If AI generation isn't configured, or fails for any reason, the PR still opens with a complete, accurate fallback description — the fix itself was never dependent on AI succeeding.
Drupal's own AI agents can now create fields, content types, and other configuration from natural-language instructions — with no developer in the loop, in some setups. Drubix reads Drupal's own AI activity log and correlates it against real configuration drift and permission audits already being collected. When both are present in the same window, that's surfaced clearly — and every one of these findings says explicitly that correlation isn't proof, because it isn't.
Every PDF report opens with a short paragraph — real severity counts, the actual most urgent finding — written for someone who isn't going to read a 12-page technical appendix. The facts are computed first; AI only turns them into a sentence a client will actually read.
Every AI feature has a complete, non-AI fallback. Fix PRs still open with a solid, accurate description. Report summaries still generate, built from a plain-English template instead of a model-written one. Nothing in Drubix's core value — real advisory matching, real confirmed findings, real remediation — depends on an AI provider being configured, being available, or working correctly on any given day.