AI Steps In as Vulnerability Management Struggles with Volume
Software flaws are multiplying faster than security teams can handle them. AI is being sold as the fix. Here's what the pitch gets right and what it glosses over.
Key points
- More than 28,000 new software vulnerabilities were logged in 2023, and 2024 broke that record.
- Security vendors are pitching large general-purpose AI models as a way to rank which flaws to fix first.
- AI can sort through data quickly, but it can also be confidently wrong, a risk known as hallucination.
- Ordinary users don't manage these systems but absorb the damage when patching falls behind.
Vulnerability management, the work of spotting software flaws and closing them before criminals can walk through, is buckling. As first reported by ThreatVectr, security vendors are now proposing frontier AI, the largest general-purpose models, the same class powering tools like ChatGPT and Claude, as a way to triage that backlog faster than any human team could.
Why is this a problem?
The public catalogue of software flaws, called CVEs (Common Vulnerabilities and Exposures), added more than 28,000 entries in 2023, then grew further in 2024. No team patches everything. So teams guess: which handful of flaws will criminals actually exploit this week? A wrong call becomes a breach. A right call on a flaw nobody wanted wastes weekend overtime and erodes trust between security and IT staff.
How can AI help?
The pitch is that a model reads every new vulnerability report, checks it against a company's real software stack, and returns a ranked list in seconds rather than hours. Large models genuinely are good at summarising technical text. That's a real match for what triage demands.
But AI also hallucinates, producing plausible-sounding conclusions that aren't grounded in fact. In this context, a confident wrong answer about which flaw is safe to skip is a serious problem. So is the opposite: flag everything urgent and teams face the same overload they started with. Our 8 August report on CISA urging immediate patching of critical software flaws showed how quickly unpatched vulnerabilities become federal emergencies. AI shifts the bottleneck. It doesn't remove it. Someone still installs the patch, tests that nothing broke, and answers to the business when a critical system reboots at 2 a.m.
Should you worry?
You probably don't run a vulnerability management programme. You do inherit the consequences when a retailer or hospital falls behind and gets breached. Keep your devices updated: phones, laptops, home routers. When a company you use discloses a breach, change that account's password and switch on two-factor authentication, the second code sent to your phone at login.
The industry is betting on AI to solve a problem it's struggled with for two decades. Whether that bet pays off will show up in next year's breach numbers, not in this quarter's sales decks.
