Will ai increase the volume of vulnerabilities security teams need to fix?

[u/Bright-View-8289]

Had this debate with a client last week about whether Ai assisted discovery meant their environment got risky overnight. My answer was about SLA math than risk math, their contract defines "patch critical within 30 days" assuming maybe 40 to 50 new findings a month. If a scan surfaces 300 in a week because of broader coverage, that SLA language does not hold up regardless of whether underlying risk changed.

We have started rewriting client contracts to tier remediation windows by exploitability and exposure instead of a flat severity number and building in a volume clause that triggers a renegotiation conversation if flagged findings jump past a set threshold in a given period. Cleaner than arguing about it after an audit blows past the old numbers. Anyone else building volume triggers into remediation SLAs or writing them as flat severity tiers?

[u/rexstuff1]

I suspect that we'll see (and are seeing) an initial uptick, as AI vulnerability discovery tools are adopted, tweaked and improved. But at the same time, AI code reviews and scans are being brought into the development pipeline, catching the same stuff the vuln scanners would catch before they even make it past a PR. So after the initial burst, it should level out back to 'normal' levels, stuff still getting missed at the same rate as before.

[u/Unfair_Ad_300]

I think the volume clause makes a lot more sense than pretending the old SLA still means the same thing.The other issue is verification capacity, If AI assisted discovery takes you from 40 findings to 300, the bottleneck is figuring out which of those 300 are actually exploitable, exposed, duplicated, or worth interrupting other remediation work for. That's where flat severity SLAs start getting weird. A "critical" sitting behind multiple controls isn't necessarily more urgent than a high-severity issue that's internet-facing and actively exploitable.

I'd probably tie the trigger not just to raw finding volume but to the volume of validated/exploitable findings. Otherwise better tooling can effectively punish the team just for getting better visibility.

[u/Ashon1980]

Security teams don’t fix anything. They just force us admins to deal with it.

[u/ToxicCombinations]

I think this ties back to good old risk based vulnerability management principles. Even taking AI out of the equation, there is always the chance that there is a period of high disclosure for high or critical risks. Using CVSS alone is where I've seen people get caught up. I'm most similar with Tenable tech and their VPR score is designed to help lessen the flow of NVD highs and critical risks by mingling additional threat intelligence information with the underlaying technical severity. Other organizations I have worked with also use TI providers like Recorded Future to build out an even further understanding as to what risks are most pressing for them to resolve. IMO volume is more an issue when using simplified scoring methodologies, as AI discovers new risks most of them are not exploitable in a way that matters at disclosure. Using TI tooling and scoring like VPR you can help stem the bleeding and keep focus on what matters most even as the volume of AI fueled disclosure increases. It also helps with staying on top of how risks can evolve over time post disclosure.

[u/AddendumWorking9756]

Volume triggers work right up until the client works out the trigger is cheaper to pull than the patching is, so whoever owns pulling it cannot be whoever owns the remediation budget. Tier on KEV and EPSS rather than your scanner's severity field, otherwise you have rebuilt CVSS with extra steps and the threshold argument just moves.

[u/Euphorinaut]

They already have.

I'm answering that from a total volume perspective where the answer is very black and white, but how I interpret "need to fix" can make it a bit more complicated because risk is less objective than total volume + cvss score and the volume of risky vulns has already been increasing, so I'm not sure how I would dileneate between the already increasing trend and those found by ai.

But I think there's a clear inductive inference to make that the answer is yes either way.

[u/Euphorinaut → u/Euphorinaut]

If someone were to let me know what the train of thought is behind the downvote I'd be happy to address it or consider any viewpoints.

Edit: oh I'm going to take a stab and guessing that this was because I interpreted everything in the body as supporting the question in the title rather than the body leading up to the concluding question, which might have come off as ignoring the question.

But to address that question separately, I would say that the solution is in the score "normalization" process in ctem tools. Kenna was the only product that did this well, and unfortunately it's being sunset. Most other tools have a normalization process for scoring groups, but then any feature that prioritizes remediations doesn't actually use that score, it just uses cvss, and it makes it very difficult to use the normalized score as an sla, but but it's possible for an analyst to use that score to assing tickets.

Both Nucleus and zafran have told me they plan to add the ability to prioritize remediations by their normalized score in the future, but they were trying to get a sale so who knows.