OmicoreShield: A framework for localizing failure modes in AI-driven cybersecurity systems

AI-driven vulnerability scanners often report false negatives without revealing whether failure originates from the AI model or the surrounding security pipeline, leading to unnecessary model scaling. We present OmicoreShield, a failure-localization framework that decomposes AI-assisted security testing into four auditable stages: attack generation, adjudication, exploit confirmation, and outcome measurement. Unlike LLM-as-a-judge approaches, OmicoreShield attributes failures using deterministic, observable execution evidence, enabling reproducible diagnosis. Controlled fault-injection experiments achieved correct stage-level attribution in 8/8 cases. In dynamic API testing, correcting the exploit-confirmation stage increased recall from 0.25 to 1.00 without increasing model size, while in infrastructure-as-code testing, removing AI-based adjudication improved detection performance. Public-benchmark analysis further revealed that an apparent model-reasoning failure was instead caused by the measurement layer. After bottleneck correction, a 14B model running locally on a single GPU was sufficient for dynamic API testing, preserving source-code and traffic privacy. In business-logic testing, conventional tools detected 0/3 planted vulnerabilities, whereas OmicoreShield confirmed 3/3. These results demonstrate that system-level failure localization should precede model scaling in AI-driven cybersecurity.