Refuted by Default: Dragos’ Methodology for AI-Driven Vulnerability Detection in OT Security Software

This report describes Dragos’s methodology for running AI-driven, adversary-modeled vulnerability hunts against its own OT codebase: building threat-model maps, running four operating modes (from single-session to large-scale harnesses), and enforcing a strict refute-first verification pipeline that requires observable proof and skeptical judgment before findings reach engineers. The program produced thousands of candidates, high refutation rates, and several confirmed issues (including critical findings), and emphasizes continuous sweeps, diff-level checks, and composition-based chain-building to harden critical-infrastructure software against AI-equipped adversaries.