Wrap-Up: A Reusable Method

The method, as a checklist

This course followed an agent through a complete security mission. Here's the pattern that emerges from it, reusable as-is:

1. Frame — precise scope, success criteria, explicit prohibitions.
2. Research — let the agent produce a broad, deliberately unsorted first pass.
3. Read critically — spot the noise, the plausible false positives, what's missing business context.
4. Verify real impact — trace actual code usage, not just the dependency's presence.
5. Propose a fix — let the agent evaluate several options, without executing any of them.
6. Get it validated — a human review split into prioritization and technical review.
7. Apply — only after approval, through the usual pipeline (PR, CI, review).

Beyond security

Nothing in this method is specific to CVEs. The same pattern applies to a technical debt review, a major dependency migration, or a large-scale refactor partly handed to an agent: frame precisely, delegate what can genuinely be delegated (research, exhaustiveness), and keep judgment and final approval human.

Going further

This course was built around one concrete running example; for a broader look at agentic methods — coding with AI agents day to day, and designing architectures meant to be operated by agents — the article Agentic Methods: Coding With AI Agents, Designing For Agents continues the discussion.