How a forgotten node can put Oracle Java back in production

Azul has rolled out Azul Intelligence Cloud AI Assistant, a natural-language layer on top of its Java runtime data. The pitch is simple: instead of relying on static scans that age the moment they’re saved, engineers can ask what is actually running right now and get an answer grounded in live runtime data.

That matters because Java estates drift. JVMs get spun up, patched, rolled back, shadowed, and retired under the feet of reports that were once accurate. Azul says most teams still lean on ITAM, SAM and code-scanning tools that describe a moment in time, while Scott Sellers, the company’s co-founder and CEO, argues that AI has turned a once-annoying visibility problem into a real business risk.

Azul’s timing is tied to the shrinking gap between disclosure and exploitation. The company cites an April 2026 Cloud Security Alliance white paper that said the median patch window for known vulnerabilities once sat at 32 days, but the median time-to-exploit in 2025 had fallen to about 5 days. The assistant sits on top of two continuously updated records: JVM Inventory, which tracks every JVM instance across on-premises, cloud and container environments, and Code Inventory, which records what code actually executes in production rather than what was merely provisioned.

The conversational interface is aimed at questions teams already ask in painful spreadsheets: which JVMs are running Java versions that are not the latest updates, where Oracle Java is running in production, or what code hasn’t executed in the past four quarters and can be removed. Azul also calls out a familiar culprit in migration work: drift. A rollback, a forgotten node, a shadow deployment, or an unupdated script can quietly reintroduce Oracle Java and bring compliance, licensing, and maybe security headaches back into the room.

The market around this is crowded enough to prove the point. Contrast Security, Dynatrace, Fortify, Imperva and Datadog all play in adjacent territory with agents, runtime analytics, RASP, APM and bytecode instrumentation. Datadog’s Andrew Krug says static inventory scans are often not representative of the runtime environment, and that LLMs are making it cheaper to create custom attack rules while defenders are still staring at yesterday’s report.