Artificial intelligence is discovering software vulnerabilities at a rate that organizations can't match when it comes to fixing them, according to a new analysis published by CSO Online. The report examines VulnOps, a framework introduced just over a year ago by industry experts Heather Adkins, Gadi Evron, and Bruce Schneier, which envisions vulnerability research and remediation becoming scalable, repeatable, automated, and woven into enterprise operations. Since its introduction, the Cloud Security Alliance has built an operating VulnOps model, SANS has released implementation guidance and plans to launch training, and practitioners have begun testing the underlying technologies.
VulnOps represents a complete overhaul of how organizations handle vulnerabilities, according to the report, not simply faster execution of existing processes. The framework calls for AI agents to automate and accelerate vulnerability management from discovery through remediation. The Cloud Security Alliance's Rich Mogull describes the shift as moving "from an iterative cycle to a continuous cycle with fast failure and feedback loops," drawing parallels to how DevOps transformed software development. Ed Skoudis, president of the SANS Technology Institute, characterizes VulnOps as "an AI-centric workflow where the AI is doing most of the analysis, and humans are just overseeing the operation." However, not all security professionals agree the concept marks a fundamental break from established practices, with SANS principal instructor Chris Elgee calling it a potential rebranding of longstanding vulnerability management challenges.
The central debate within VulnOps centers on whether human oversight can survive when remediation must operate at the speed AI demands. Most security professionals resist removing humans from the loop entirely, the report notes. Mogull cautions that the industry isn't close to fully automating remediation and emphasizes that humans remain accountable, pointing to the CSA model where AI makes decisions within predefined policies but disruptive changes still require human intervention. Skoudis advocates for what he terms governance-in-the-loop, where organizations set thresholds below which AI can act autonomously—for example, deploying critical Windows workstation patches on a rolling basis without human review. Evron takes a more radical position, arguing that "human in the loop is dead" because people "simply can't move fast enough for the vast majority of operations." He goes further, questioning whether autonomous patching itself will prove adequate as AI accelerates both vulnerability discovery and exploitation.
Looking beyond automated patching, Evron recommends three approaches for a future where traditional patch cycles may become obsolete: embedding security controls directly into AI coding agents to generate more secure code from the outset, detecting and neutralizing attacks at runtime as they occur, and implementing defense-in-depth strategies that make individual vulnerabilities less urgent to patch immediately. For CISOs navigating this transition, the report offers divergent advice. Evron urges security leaders to stop relying solely on established practices that may blind them to how AI is reshaping the threat landscape, while Skoudis recommends starting small by establishing governance boundaries within which AI agents can operate autonomously. Ali Khan, CISO of Iru, emphasizes that security and engineering teams must renegotiate their relationships, as security can't simply hand developers remediation tickets and expect faster results. Evron believes existing teams can handle the shift to VulnOps, but only if organizations reduce dependence on vulnerability scanning tools and instead build systems that enable trusted autonomous patching in the near term—while planning for a longer-term future where patching alone won't suffice. The immediate imperative, according to the analysis, is to begin implementing autonomous patching frameworks today while simultaneously preparing for defensive architectures that don't rely on fixing flaws after they're discovered. Security leaders who cling exclusively to reactive vulnerability management risk falling permanently behind an AI-accelerated threat curve, while those who experiment thoughtfully with automated remediation may buy time to architect more resilient systems.