Vulnerability management is drowning, and AI is being sold as the lifeboat
Security teams face more software flaws than they can patch, and vendors are pitching frontier AI as the fix. Lucy Green looks at what that actually means for the people running these programmes.
Key points
- Vulnerability management, the process of finding and fixing software flaws before criminals exploit them, is buckling under the sheer volume of reported bugs.
- More than 28,000 new vulnerabilities were catalogued in the public CVE database in 2023, and 2024 broke that record again.
- Security vendors are now pitching frontier AI, meaning the largest general-purpose AI models, as a way to triage and prioritise fixes.
- The bottleneck is not detection: scanners already find plenty. It is deciding what to patch first and getting it done.
- Ordinary users are not the audience here, but they inherit the risk when companies fall behind on patches.
Vulnerability management is one of the oldest jobs in cybersecurity. Find the flaws in your software. Rank them. Get them fixed before someone breaks in through one.
For decades, that job has been a partnership between two teams: the people who scan for problems and the people who apply the patches, which are the small software updates that close a security hole. The relationship has always been tense. It is now close to breaking.
Why is the old approach failing?
There are simply too many flaws to fix. The public catalogue of software vulnerabilities, known as CVEs (short for Common Vulnerabilities and Exposures), logged more than 28,000 new entries in 2023 and set another record in 2024. No security team, however well staffed, can patch everything.
So teams triage. They try to work out which handful of flaws, out of thousands, are the ones criminals will actually use this week. That guesswork is where programmes fall down.
A missed call becomes a breach. A patched flaw that nobody was ever going to exploit becomes wasted weekend overtime. Both outcomes erode trust between security and the IT staff who have to install the fixes.
What is "frontier AI" and why is it suddenly in the pitch deck?
Frontier AI is the industry's label for the biggest, most capable general-purpose AI models, the same class of system that powers tools like ChatGPT and Claude. Security vendors, in coverage this week from The Hacker News, are pitching these models as a way to read every new vulnerability report, cross-reference it against a company's actual software, and rank what matters.
The promise is straightforward. Instead of a human analyst spending an hour reading advisories and threat feeds, a model does it in seconds and hands back a short list.
The pitch is not fantasy. Large models are genuinely good at summarising technical text and spotting patterns across messy data. That is much of what vulnerability triage is.
Does it actually work?
Early signs are promising but unproven at scale. AI can rank flaws faster than a person, but it can also be confidently wrong, a behaviour known as hallucination, where the model invents plausible-sounding details that are not true.
In vulnerability management, a hallucinated "this one is safe to ignore" is a genuine problem. So is the opposite: an AI that flags everything as urgent recreates the same alert fatigue teams already suffer from.
The honest read is that AI shifts the bottleneck. It does not remove it. Someone still has to install the patch, test that nothing broke, and answer to the business when a critical system reboots at 2am.
What should this mean for the rest of us?
Ordinary customers do not run vulnerability management programmes. They do inherit the consequences when a bank, hospital or retailer falls behind on patches and gets breached.
The practical takeaway is small but real. Keep your own devices updated: phones, laptops, home routers. When a company you use discloses a breach caused by an unpatched flaw, take the notification letter seriously, change the password on that account, and turn on two-factor authentication, which is the second code sent to your phone when you log in.
The deeper story here is that the industry is betting on AI to dig itself out of a hole it has been in for twenty years. Whether that bet pays off will be visible in next year's breach reports, not in this quarter's marketing.
