Security teams are hearing two competing stories. In one, AI completely rewrites the rules of vulnerability discovery, exploitation, and remediation. In the other, AI simply adds speed and scale to problems that security programs already understand. The reality lies somewhere in between.

Discovery Is Accelerating Faster Than Decision-Making

AI analyzes code, generates findings, and proposes patches but organizations still rely heavily on “human in the loop.” In this mode, there is no way humans can ever keep up. Instead, teams must use AI to improve visibility and prioritization processes, so humans can approve the remediation steps necessary to successfully be proactive in their security programs.

Every Role Feels The Pressure Differently

Vulnerability management teams face more findings and shorter exposure windows, such as with the PHP2Shell vulnerability, where organizations and government agencies witnessed attacks prior to the planned disclosures. Application security teams must evaluate rapidly improving AI models for vulnerability discovery in codebases without tying their programs to one model or security provider. To do this, security teams must experiment with the different types of vulnerability harnesses from open source such as Capital One’s VulnHunter to commercial solutions such as Microsoft’s MDASH. Product and development teams inherit AI-generated findings and patch proposals alongside features, defects, and technical debt. Security operations teams inherit residual risk when remediation misses its window.

Validation Becomes The Bottleneck

Google claims that up to 75% of its new code is now written by AI, while an analysis for GitClear reports that up to 25% of commits had AI assistance. But according to research from 1Password, AI-generated changes can alter application behavior, fail to resolve the vulnerability, or introduce a new weakness. A regression issue in production can have catastrophic impact. Humans still don’t trust AI to fix and commit changes without human review, prompting new projects from organizations like OWASP’s OASIS that gamify human review of AI suggested fixes, making review the latest bottleneck for improved security. We expect a reliance on AI to fix code to start to have headwinds, which is why we are predicting that in 2027 an AI-generated bug or regression will cause a global outage across multiple industries. A successful AI-led remediation strategy emphasizes resilience, not volume.

Context Is Your Home-Field Advantage

Knowing what is reachable, what is monitored, what supports critical customer services, which controls actually work, and where downtime carries unacceptable consequences is your advantage against attackers wiggling doorknobs. If you can scale your context with discovery, then you can also scale better prioritization.

Hear More From Us In Person

Join us at the Security & Risk Forum on November 9 in Washington, DC to learn how to move beyond the red-or-blue debate and build a program that can validate, decide, and act at machine speed without surrendering human accountability.

Share