AI's Impact on Vulnerability Management: Did It Revolutionize or Expose Flaws?

Post Views: 13

AI is not dismantling vulnerability management; it is revealing long-standing flaws in the system.

The traditional vulnerability management process has collapsed

The traditional vulnerability management process, which relied on scanning, prioritizing, and patching, has collapsed. This system was already under pressure before the emergence of AI-driven tools like Mythos. However, regardless of the actual effectiveness of such models, organizations are increasingly concerned about their capacity to manage the surge of vulnerabilities identified by artificial intelligence. This anxiety is justified.

The NVD’s growing backlog

Evidence shows that vulnerability management has struggled to scale effectively, with issues dating back long before AI became adept at uncovering flaws. The number of CVE submissions to the National Vulnerability Database (NVD) increased by 263% between 2020 and 2025. Early 2026 data already indicates a nearly one-third rise compared to the same period in 2025.

The shift to a risk-based approach

In 2025, NIST enriched nearly 42,000 CVEs—a 45% increase over previous years—but this effort proved insufficient. To address the backlog, NIST transitioned to a risk-based approach, prioritizing only the most critical CVEs for detailed analysis. Over 29,000 CVEs with publication dates prior to March 1, 2026, were reclassified as “Not Scheduled,” allowing NIST to reduce its backlog through reorganization.

The acceleration of vulnerability discovery

This shift has created gaps in the official record, a problem that will intensify as AI accelerates vulnerability discovery. Projections suggest over 50,000 CVEs could be reported in 2026 alone, with these numbers not yet accounting for tools like Claude Mythos and GPT-5.4-Cyber, which promise to identify flaws at unprecedented speeds.

The shrinking window for remediation

These developments underscore the limitations of conventional vulnerability management frameworks. The time between disclosure and exploitation has also shrunk dramatically. Research shows 61% of vulnerabilities are exploited within 48 hours of being made public. By the time a flaw reaches “analyzed” status in the NVD and navigates traditional prioritization workflows, the breach may have already occurred.

The rise of continuous threat exposure management (CTEM)

This reality has accelerated the industry’s move toward continuous threat exposure management (CTEM), a critical evolution rather than a passing trend. CTEM expands the scope of risk assessment beyond software vulnerabilities and CVEs to include any exposure that threatens data, identities, or infrastructure. This encompasses credential leaks, malicious domains, misconfigurations, and compromised devices.

Why CTEM is essential in the AI era

The breadth of this approach is vital as AI can rapidly link CVEs and non-CVE exposures into attack paths that outpace traditional defenses. Implementing CTEM requires more than technical adjustments—it demands a cultural shift. Many teams mistakenly believe they must future-proof their processes before adopting new methods. This mindset is misguided.

Adaptability in the face of AI advancements

Adaptability is essential in an era of rapid AI advancements. Organizations need CTEM programs that integrate new tools, intelligence sources, and automation without requiring complete overhauls. Modern business environments are interconnected, necessitating swift responses to evolving threats.

The risks of complacency

Teams that assume the gap between “known” and “weaponized” vulnerabilities will remain wide enough for traditional remediation are taking significant risks. While future advancements in AI could lead to safer code and fewer zero-day discoveries, this scenario is not yet a reality. Currently, vulnerability discovery is outpacing traditional remediation models.

The path forward: CTEM and autonomous remediation

Security teams require continuous, agile programs capable of operating in dynamic threat landscapes. Achieving this will involve restructuring teams and workflows to enable cross-domain collaboration that matches AI-driven threats. It also means embracing autonomous remediation, a concept many have resisted since the IDS/IPS era.

Human oversight in an automated world

However, autonomous remediation is unlikely to eliminate security roles. Instead, it will necessitate closer collaboration across teams, with humans maintaining oversight for critical decisions. Most organizations recognize the need for adaptation, understanding that the transition to CTEM is urgent.

Conclusion: AI exposes flaws, not replaces systems

AI is not dismantling vulnerability management; it is revealing long-standing flaws in the system. CTEM offers a viable path forward, but the urgency to act remains pressing. While humans cannot match machine speed, systems can be designed to operate at such levels. AI is not waiting for the industry to catch up.

According to NIST, the shift to a risk-based approach has allowed the agency to reduce its backlog through reorganization, but this has created gaps in the official record.