AI Finds Vulnerabilities 10x Faster Than Teams Can Patch Them

BLUF: AI is accelerating vulnerability discovery to unprecedented levels, forcing organizations to shift from periodic patching to continuous, agentic remediation to manage the exploding backlog 1:35.

Key Takeaways:

• Surge in Vulnerability Discovery: AI tools are being widely adopted by researchers and internal teams, leading to a 92% year-over-year increase in vulnerability submissions across platforms like HackerOne 2:08. This trend is visible even in hardened environments; for example, Chrome and Firefox disclosed more vulnerabilities in a few months than in the previous three years combined 4:52.

• Disparity in Remediation Capacity: While tech giants like Google can pivot hundreds of engineers to fix issues, the open-source ecosystem is struggling. Projects like Linux and curl are facing unmanageable backlogs because they lack the resources to keep pace with AI-driven discovery 7:10.

• Need for Continuous Operations: Traditional monthly or weekly vulnerability management cadences are obsolete. Organizations must adopt "always-on" intake, triage, and response processes to handle hourly influxes of findings 9:14.

• Leverage AI for Security Debt: Teams should use AI to tackle legacy security debt by eliminating entire bug classes through architectural changes, such as robust input validation, rather than fixing individual bugs 10:07.

• New Metrics for Success: Key performance indicators must shift. "Time to validation" must be reduced to hours, and "time to remediate" should aim for sub-day or sub-hour targets using agentic tools, rather than relying on legacy 30-60 day SLOs 12:10.

The gap between discovery and remediation is widening, but by adopting agentic workflows and redefining best-in-class metrics, security teams can regain control. The focus must shift from fear of AI to leveraging it for rapid validation and engineering-led debt reduction.

Sources:

• 1:35 Introduction of the core thesis that AI is actively finding vulnerabilities.
• 2:08 Data showing a 92% year-over-year increase in vulnerability submissions.
• 4:52 Examples of Chrome and Firefox seeing record vulnerability disclosures.
• 7:10 Open-source projects like Linux and curl struggling with unmanageable backlogs.
• 9:14 The necessity of shifting to continuous, always-on remediation processes.
• 10:07 Using AI to eliminate entire classes of bugs and reduce security debt.
• 12:10 The need for new metrics like time to validation and sub-day remediation times.