Security teams are preparing for an increase in AI-discovered vulnerabilities, but the primary concern is not the sheer number of flaws but how they are being exploited. Nathan Smolenski, chief information security officer at Qualys, notes that while AI is identifying more vulnerabilities, only a small fraction pose immediate danger. Those that do, however, are more likely to enable remote code execution when combined with other vulnerabilities.
Data supports this shift. In 2025, FIRST, a cyber threat tracking consortium, recorded 66,000 global vulnerabilities. This gap reveals a key issue: most vulnerabilities are irrelevant, but the dangerous ones are becoming more sophisticated.
AI is not only detecting more flaws but also uncovering combinations that evade traditional defenses. A single low-severity issue can become critical when linked to others, creating attack paths that automated systems overlook. This extends the exposure window far beyond the standard Mean Time To Remediate (MTTR), which begins at disclosure. Smolenski argues that tracking the average window of exposure (AWE) is more useful than MTTR. AWE measures the time between when an exploit becomes active in an environment and when it is patched, exposing gaps in current processes.
Prioritization has always been important, but AI-driven attacks require faster decision-making. Teams already rank vulnerabilities by risk, but AI-driven threats demand real-time adjustments. An infrastructure exploit may shift from low to high priority within hours as new attack chains emerge. Moving from monthly spreadsheets to live threat intelligence is essential, but it requires detailed business justifications for each risk. Without this, teams may overreact to noise or overlook genuine threats.
The greater risk is not automation itself but the misleading confidence AI-generated alerts can create. The solution lies in separating AI suggestions from validation. Only human-verifiable telemetry can confirm a fix before it is applied. Without this, automated remediation becomes another source of uncertainty.
Anthropic’s Glasswing tool identified over 6,000 high- or critical-severity vulnerabilities in 1,000 open-source software packages. Mozilla’s audit of Firefox uncovered 22 issues, some rated high severity. These findings highlight a growing trend: AI-driven vulnerability discovery is no longer theoretical but already impacting widely used software. The challenge for security teams is not just managing the volume of disclosed vulnerabilities but identifying which ones AI is actively weaponizing in real attacks.
For organizations hesitant about full automation, supervised deployment is an option. Automation can handle packaging and configuration changes, staging them for human review before full rollout. This allows teams to focus on complex or mission-critical patches while accelerating remediation. Patchless mitigations and virtual patching can also provide temporary protection while proper fixes are developed. Balancing speed with safety is critical, especially under regulatory deadlines like the U.S. Federal BOD 26-04, which requires patching critical issues within three days. Meeting these timelines demands scalable, repeatable processes rather than faster human labor.
Leave a Reply