AI Finds Security Flaws Faster Than Firms Can Fix Them, Creating a Vulnerability Storm

AI Accelerates Vulnerability Discovery to Machine Speed

AI is transforming cybersecurity by discovering software vulnerabilities faster than organizations can address them, creating what security experts call a vulnerability storm1

1

. The technology is accelerating how software is analyzed, weaknesses are uncovered, and exploits are developed—fundamentally widening the gap between vulnerability discovery and remediation. This asymmetry represents a critical shift in enterprise security: while AI-driven vulnerability discovery operates at machine speed, patching and fixing remain constrained by the realities of enterprise technology infrastructure and processes.

The scale of this challenge is staggering. Based on current run rates, vulnerability disclosure volume is projected to increase by almost 100% over 2025, pushing the annual total toward 100,000 vulnerabilities according to the National Vulnerability Database (NVD)1

1

. This is no longer incremental growth—it represents a fundamental step change in the number of vulnerabilities security teams must assess, prioritize, and remediate. For enterprises, this escalation transforms vulnerability management from a security operations problem into a question of business risk that could disrupt critical services, affect customers, or create material financial and regulatory consequences.

Anthropic's Claude Mythos Jolts Industry Into Action

The April 7 disclosure of Anthropic's Claude Mythos capabilities for discovering and exploiting software vulnerabilities at unprecedented speeds triggered immediate mobilization within businesses and government2

2

. Given that many companies can take weeks or months to patch vulnerabilities after disclosure, the prospect of a monumental surge in new software bugs was met with attention—and even panic—within the highest levels of industry and government. The six months following Mythos have seen massive changes sweep the industry on vulnerability and exposure management, though progress has been far from even across organizations.

Kathryn Hall, senior vice president of services at Optiv, noted that Mythos "has really created an opportunity for our clients to push their threat exposure management agenda into the board—because boardrooms are now listening"2

2

. The result has been "a lot of really meaningful momentum" in a relatively short span, though the degree of progress has significantly varied by organization. The arrival of Mythos and subsequent frontier AI advancements in the area, including from OpenAI and open-weight models, has fundamentally altered how businesses approach vulnerability management.

Severity and Volume Create Unprecedented Pressure

Volume alone doesn't capture the full scope of the challenge facing cybersecurity teams. Across the large population of vulnerabilities disclosed in 2026, severity remains significant, with average CVSS (Common Vulnerability Scoring System) scores reaching 7.19 in August according to NVD data1

1

. Security teams are therefore dealing not only with unprecedented vulnerability volume, but with a substantial population of materially severe vulnerabilities competing for attention and remediation resources.

The window between disclosure and operational exploitation has compressed dramatically. Recent incidents demonstrate how quickly threat actors can move: CVE-2026-87902 in WordPress Core was publicly disclosed on September 22, 2026, with exploitation attempts observed the same day1

1

. Exploitation progressed from vulnerability probing to attempts to achieve code execution within hours. By the following day, public scanning tooling was already circulating. The window between disclosure and operational exploitation is no longer reliably measured in weeks or even days—in some cases, it is measured in hours. This faster exploitation creates another challenge for defenders: prioritization itself has to move faster.

Vulnerability Chaining Changes Risk Assessment

Traditional vulnerability management largely evaluates findings individually, with a CVSS 9.8 receiving immediate attention while a CVSS 5 or 6 sits much further down the remediation queue1

1

. However, threat actors do not operate one vulnerability at a time. A moderate vulnerability may provide initial access, another may enable lateral movement, a misconfiguration may expose the next system, and excessive privileges may enable escalation. Individually, none may appear critical—together, they can create a critical attack path.

AI shaking up vulnerability management extends to making it faster to identify and analyze these relationships across vulnerabilities, configurations, identities, privileges, and network paths. The implication is fundamental: business risk may no longer sit in a single vulnerability but in the chain. Organizations have always used context to prioritize vulnerabilities—asset exposure, criticality, configuration, security controls, privileges, and threat activity. What is changing is the speed at which that context can change. A vulnerability considered manageable today can become urgent tomorrow because a working exploit appears, an asset becomes internet-facing, a preventive control fails, privileges change, or a new attack path emerges.

Organizations Rethink Vulnerability Management Strategies

For Accenture, the typical customer conversation has changed dramatically since the initial alarm over AI-powered vulnerability discovery sparked by Mythos, according to Jason Lewkowicz, global lead for cyber resiliency and defense2

2

. Initially, calls from concerned clients had largely centered around how to patch vulnerabilities more rapidly. "In the beginning, it was probably 80 percent, 'Let's go patch faster and play whack-a-mole,'" Lewkowicz said. However, as time went on, many customers have come to see the limitations of that approach and recognize the need for a broader update to their strategy. "Now it's probably 80 percent in the bucket of, 'Let's really rethink our approach to this.'"

This is translating into heightened interest among customers in methods such as continuous threat exposure management (CTEM) and attack surface identification, as well as penetration testing and offensive security. Gary Brickhouse, CISO at GuidePoint Security, confirmed that Mythos has accelerated a transition toward CTEM that was already underway. "Mythos is fast tracking it, frankly—and organizations probably are having to deal with it at a faster clip than they were originally planning to," Brickhouse said2

2

. The truth is that CTEM is more of an ongoing approach to understanding and reducing exposure, as opposed to a particular goalpost that an organization reaches. The idea is for businesses to be continually assessing their attack surface and identifying new routes an attacker could take.

Context Changes Faster Than Security Frameworks Can Adapt

When context is collected periodically and a vulnerability is placed into a remediation queue, that assessment can become outdated within days or even hours1

1

. The challenge is no longer simply having the right context—it is keeping that context current enough to reassess priority as conditions change. The CVE has not changed, but the context has. This dynamic environment requires organizations to move beyond traditional security frameworks that rely on periodic assessments and static prioritization models.

The scale problem is already affecting the vulnerability ecosystem itself, with even the National Vulnerability Database having to prioritize its own processes. As new capabilities boost visibility in vulnerabilities and help with identifying the most important exposures to address, many businesses are still running into familiar obstacles getting in the way of rapidly fixing vulnerable software2

2

. Organizations must now balance the imperative to act faster with the practical constraints of enterprise technology environments, making vulnerability management a critical component of overall business risk management rather than purely a technical security function.