Arista is preparing to release a higher-than-usual amount of security advisories affecting Arista EOS and VeloCloud.
Arista Networks has taken the unusual step of warning customers that next week, it will release multiple security advisories affecting Arista EOS and VeloCloud. AI-driven changes to its vulnerability detection processes have resulted in a higher-than-usual volume of security updates, the company says, and the advance notification is aimed at helping its customers plan.
“We’re pre-announcing this, ahead of the detailed disclosures, so your teams have a heads-up. For at least the next few months, while we address the issues discovered with these new tools, we expect an elevated volume of security advisories and batched releases,” wrote Arista’s Kenneth Duda, president and CTO, and Jason Bevis, area vice president and chief information security officer, cybersecurity, in a blog post. “We know that a predictable rhythm is easier to plan around, staff for, and roll into existing change-control processes than advisories that show up piecemeal with no warning.”
On September 09, the full details of each advisory—including specific CVE information, severity scores, affected versions, and remediation instructions—will be published on the Arista Advisories and Notices page.
“To be direct about what to expect: over the coming week, watch for a first batch of security advisories from Arista, each with a software fix and remediation guidance included,” the authors wrote. “We encourage you to make sure you’re subscribed to our security advisories now, so nothing lands in your inbox as a surprise, and to use CloudVision’s Compliance Dashboard to get ahead on triage as soon as the advisories are live.”
“We know asking security teams to prepare for ‘more advisories, but on a schedule’ is an unusual thing to pre-announce. We’re doing it because we’d rather you hear it from us, with time to plan, than discover it the hard way. That’s the partnership we’re aiming for as this next era of AI-accelerated security unfolds, and we’ll keep talking to you openly as it does,” Duda and Bevis wrote.
AI-enhanced security efforts
The Arista execs said that the anticipated spike in alerts is the result of recent work with Anthropic, Google, OpenAI, and others to integrate new AI-enabled security capabilities from foundation models into Arista’s existing software security pipeline:
“Through access to models such as Mythos and Daybreak and being invited early as a key infrastructure supplier into partnerships like Project Glasswing, we’ve been layering AI-driven vulnerability discovery and assessment onto our established security vulnerability management process. The result is a more thorough security review process operating at a much faster machine pace. We’ve been using this capability proactively to find vulnerabilities in our own software before anyone else does,” the authors wrote.
“We’re heading into a period when frontier AI can find and weaponize software flaws in minutes rather than months. That capability cuts both ways: it’s why our AI-enabled security efforts work, and it’s also why the volume of vulnerabilities disclosed across the application and infrastructure software industries worldwide is set to spike, and ‘patch-and-pray’ was never a strategy built for this pace,” Duda and Bevis wrote.
“The people on the front lines of this fight are already stretched thin, fielding advisories from dozens of vendors, triaging what actually matters to their environment, and finding maintenance windows in networks that were never supposed to go down,” the authors stated. “They deserve better tools and a better architecture to work from, and that is our ongoing commitment to you: not just more security advisories, but security advisories delivered in a way you can actually plan around, backed by architectural advantages we’ve spent two decades building into Arista EOS and capabilities designed to limit how much damage any particular vulnerability can cause.”
A quick look at Arista’s security advisories over the past year shows that it averages about two per month. It is unclear what next week will bring; Arista stated only that it expects multiple advisories to be included in the upcoming release, affecting Arista EOS and VeloCloud.
