Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

An initiative named Scan for Good was launched to use AI and human security researchers to find public exposures and complex attack paths across public services, critical infrastructure, and nonprofits. The effort aimed to help defenders secure vital systems by discovering risks before malicious actors exploit them. Early efforts resulted in uncovering hundreds of public exposures that were fixed through collaboration with affected organizations. The project received support from Google DeepMind and the Cybersecurity and Infrastructure Security Agency (CISA).
The core methodology involved applying AI, specifically using tools like the Wiz Red Agent, to examine publicly facing websites, APIs, and applications to discover risks. Real-world environments often present risk not from single code vulnerabilities but from complex combinations of configurations, permissions, and application behaviors that form dangerous attack paths. This process leverages AI to rapidly identify these interconnected weaknesses in high-value targets such as critical infrastructure, public services, healthcare, and nonprofits.
The project has already yielded results, including fixing exposures like exposed administrator keys in national archives, missing access controls in public hospitals, and vulnerabilities in foundational digital infrastructure platforms. The approach emphasizes a proactive security posture, prioritizing testing where authorized and involving human researchers for validation and remediation support before disclosure.

* Scan for Good uses AI coupled with human security researchers to uncover public exposures and attack paths.
* The initiative aims to help defenders secure systems by finding risks before exploitation.
* Efforts resulted in fixing hundreds of public exposures through collaboration with affected organizations.
* Google DeepMind and CISA partnered on the project.
* AI-powered tools, such as the Wiz Red Agent, were used to examine publicly facing assets.
* The work focused on identifying risks arising from combinations of configurations, permissions, identities, APIs, and application behaviors.
* Examples of remediated exposures include an exposed administrator key in a national archive and missing access controls in a public hospital.
* Foundational digital infrastructure examples involved missing access controls in AI training data platforms and vulnerabilities in cloud infrastructure provider workflows.
* The process involves human researchers validating AI findings and collaborating with organizations on remediation.

The narrative frames the advancement of offensive AI as necessitating a parallel, proactive defensive strategy focused on discovering and managing public exposure. The shift highlighted is from vulnerability hunting in code to understanding complex, emergent attack paths formed by system configurations and connections. This reflects a systemic pressure: as exploitability increases due to AI advances, the resource disparity between powerful threat actors and under-resourced defenders widens, creating an urgent need for scalable discovery methods.
The mechanism of Scan for Good—using AI to accelerate the discovery of these complex pathways while retaining human oversight for validation and disclosure—suggests a tension between automation speed and necessary human accountability. The focus on public interest organizations and critical infrastructure illustrates a potential pathway where advanced defensive capabilities, when democratized through data-driven analysis, can level the playing field against sophisticated adversaries.
The pattern emerging is an attempt to operationalize theoretical AI capabilities into tangible societal security gains. However, the reliance on collaboration and authorization places constraints on the scope of automated discovery, raising questions about who controls the definition of "critical exposure" and how this collaborative process avoids becoming a form of outsourced risk management rather than true empowerment. What are the long-term implications for defining the boundaries between public research and operational security execution?