Google Mantis: Ushering in an Era of AI-Powered Automatic Security Diagnosis and Remediation

Security Teams’ Fundamental Problem: The Battle Between Signal and Noise

If your team handles security, you experience a nightmare daily:

Hundreds of vulnerability alerts arrive. But most are false.

According to research released by Google, existing security scanning tools have a true-positive rate of less than 7%. In other words, your team repeats the following cycle daily:

1. An automated scanning tool reports 500 vulnerabilities
2. Developers manually verify each one
3. Most are deemed “not actually a problem”
4. About 35 turn out to be actual security issues

This process is enormously costly. Team time is wasted, and genuine risks are buried in the noise.

Google’s Mantis aims to address this problem through AI-based design.

Mantis Innovation: “AI Filters Out False Claims”

Mantis’ core is simple yet powerful:

When one agent identifies a vulnerability, other agents verify it.

Multi-Layer Verification Structure

Mantis is designed as a structure where multiple AI agents perform verification at each stage. By having one agent’s findings verified by another agent, it aims to reduce false positives.

Because each agent goes through sequential verification stages, meaningful vulnerabilities are more likely to be reported to the team.

Hypothetical Scenarios: Mantis Usage Potential

Scenario 1: Startup Security Automation

Situation: Development team without dedicated security staff

Existing tools generate many false positives, consuming team verification time. Through Mantis’ AI-based filtering, teams can focus on meaningful vulnerabilities.

Scenario 2: Large-Scale Migration Projects

Situation: Migrating legacy systems to modern frameworks

By reducing the burden of manual code review and automatically validating security issues that might otherwise be missed, migration projects can proceed more securely.

Scenario 3: Open-Source Project Maintenance

Situation: Need to manually verify security with each PR

When Mantis automates initial verification of contributor-submitted code, maintainers can focus on actual decision-making.

Realistic Limitations and Expectations: Why Mantis Isn’t “Perfect”

Even though Mantis is innovative, it doesn’t solve every problem.

Current Limitations

1. Cannot find 0-day vulnerabilities

   • Mantis is trained on “known patterns”
   • Completely new attack techniques cannot be detected

2. Weak on business logic vulnerabilities

   • Determining “is this access control truly correct?” is difficult
   • Design-stage problems cannot be discovered

3. Complete elimination of false positives is limited

   • AI can make mistakes; not all false positives can be perfectly filtered
   • The possibility of remaining false positives should be considered

Conclusion: Why This Technology Matters

Mantis is not “just another security tool.”

This is a paradigm shift.

Conventional security automation:

Discovery (Automated) → Verification (Manual) → Remediation (Manual)
                     ↑ Most time consumed here

AI-based security automation (Mantis):

Discovery (Automated) → Verification (Automated) → Remediation (Automated)
                                           → Team makes priority decisions

Who Should Use It Now?

✅ Strongly Recommended:

• Startups without security teams
• Companies undertaking migration projects
• Open-source maintainers

⚠️ Adopt Cautiously:

• Highly regulated industries (finance, healthcare)
• Those expecting perfect automation

Next Steps

1. Start with small projects → One team’s microservices scale
2. Review results → “Does this accurately reflect our risk profile?”
3. CI/CD integration → PR automation
4. Culture shift → “Security review = AI + human collaboration”

Google Mantis is a tool that “returns security to programmers.”

Without a dedicated security team, it means AI can automate vulnerability verification—something humanity has done manually—at a trustworthy level.

Security is no longer “the security team’s responsibility”—it’s becoming enterprise-wide automation.

This is the change we need to see.