The organizations that adapt will treat remediation as an engineered system, not a recurring fire drill.

By Joel Bruesch, CISO at Helix

AI Changes the Vulnerability Equation

Most organizations know the traditional patching cycle: a recurring cadence for vulnerable and outdated software, often scheduled during lower-impact maintenance windows. A zero-day is different. It receives crisis-level attention because the organization may have little warning, no proven playbook, and a rapidly changing risk picture.

AI will not simply produce more zero-days. It could dramatically increase the number of previously unknown vulnerabilities that organizations must rapidly assess for exploitability, exposure, control coverage, and business impact. The crisis is therefore broader than patching. It includes triage, prioritization, routing, remediation, and verification at machine speed.

The direction of travel is already visible. Google Threat Intelligence Group reported that exploited zero-days rose 15% in 2025, with 44% targeting enterprise technologies, the highest share recorded in its review.

Now imagine the cycle amplified: not one urgent discovery at a time, but hundreds or thousands arriving in quick succession. In May 2026, Anthropic CEO Dario Amodei warned that banks, governments, and technology companies might have only six to 12 months to remediate flaws found by Anthropic’s Mythos model before other models reach similar capabilities. His warning was an “enormous increase in the amount of vulnerabilities.”

Stop Asking Heroes to Hold It Together

The urgent question is no longer only how to find vulnerabilities. It is whether the organization can absorb and resolve them fast enough. Remediation across complex production environments can take weeks or months once testing, change control, maintenance windows, dependencies, communications, and rollback requirements are factored in.

Many organizations still depend on experienced individuals to coordinate that work manually: opening changes, finding approvers, confirming prerequisites, negotiating maintenance windows, notifying stakeholders, tracking execution, and resolving failures. Those people are indispensable, but heroics are not a scalable operating model. The process must remain reliable when volume spikes, priorities collide, or a key employee is unavailable.

Not Every Vulnerability Is a Fire Drill

The answer cannot be to treat every AI-discovered vulnerability as a zero-day emergency. That would replace a vulnerability backlog with an emergency-change backlog and increase the likelihood of production disruption.

Organizations need risk-based triage that distinguishes urgent exposure from routine remediation. Prioritization should combine evidence of active exploitation, credible exploitability, external reachability, privileged access, asset and service criticality, business impact, available mitigations, and the reliability of the underlying finding. CVSS severity can inform the decision, but it should not make the decision by itself.

You Can’t Automate What You Don’t Understand

Automation only works when it begins with trustworthy context. A vulnerability that cannot be mapped to a system, application, business service, exposure path, and accountable remediation function will still fall into a manual queue.

Coverage therefore matters before compliance percentages do. Organizations should know which assets are in scope, which are scanned or otherwise assessed, which remain blind spots, and which business services would be affected by remediation or exploitation. A favorable patch rate calculated against an incomplete inventory can create confidence without control.

Think Factory, Not Fire Drill

Traditional vulnerability programs often identify an asset owner and hand the problem over. At scale, that simply moves the orchestration burden downstream. The server owner may still need to determine whether the fix belongs to the operating-system team, database team, middleware team, application team, cloud platform team, or several of them together.

Security must own the quality of that handoff. Vulnerability records should be enriched with asset, service, exposure, dependency, and remediation context so corrective actions reach the function capable of executing them. At AI scale, routing accuracy becomes as important as detection accuracy.

The workflow should operate like a factory: create the required change and work items, apply policy and approvals, complete prerequisites, coordinate stakeholders, execute the corrective action, manage failures, and preserve traceability. Software should perform repeatable coordination; people should govern risk, exceptions, and production safety.

A Fix Isn’t Finished Until It’s Verified

“Patching” is shorthand for a wider remediation lifecycle. Some findings require a software update. Others require a configuration change, code correction, container or base-image rebuild, service isolation, feature disablement, credential rotation, or a compensating control while a permanent fix is developed.

A deployment status of “successful” is not the same as verified risk reduction. The organization must confirm that the vulnerable version or configuration is no longer present, the affected service restarted or redeployed as required, the exposure path is removed, and the scanner or validation method recognizes the changed state. The operating sequence should be continuous: discover, assess, prioritize, route, remediate, verify, close, and learn.

Sometimes the Goal Is to Buy Time

Not every high-risk vulnerability can be permanently remediated immediately. When a safe patch is unavailable, a maintenance window cannot be opened, or a dependency blocks the fix, defense-in-depth controls can buy time.

Those controls may include segmentation, exploit prevention, endpoint detection and response, intrusion prevention, web application firewall protections, isolation, or temporary feature restrictions. They do not erase the underlying vulnerability. Their purpose is to reduce the likelihood or potential impact of exploitation while the permanent corrective action proceeds. Exceptions should be explicit, time-limited, owned, and reviewed.

Measure Whether You’re Keeping Up

The boardroom cares less about the mechanics of patch deployment than whether the organization’s capacity to reduce exposure can keep pace with the rate at which new exposure is created. Four questions provide a practical executive view:

1. Coverage: What percentage of in-scope assets and services is visible to vulnerability detection and remediation processes, and where are the blind spots?
2. Baseline execution: What percentage of systems meets the organization’s normal patch and update policy?
3. Risk remediation performance: What percentage of vulnerabilities is remediated within risk-based service targets, especially those that are actively exploited or externally exposed?
4. Exposure debt: How many material findings and exceptions are beyond target, how old are they, and is the backlog growing faster than the organization can close it?

The trend matters as much as the point-in-time percentage. If the arrival rate of material vulnerabilities consistently exceeds verified closure capacity, the control environment is accumulating exposure even when teams are working at full effort.

Cyber Resilience Is Becoming a Capacity Question

AI may also compress the time between discovery and reliable exploitation, making remediation windows that once appeared reasonable increasingly difficult to defend. Anthropic’s Mythos preview reported that the model produced 181 working exploits in one test, compared with two from the prior model.

The answer is not simply more people working a larger queue. AI-scale discovery requires AI-assisted triage and automation across the remediation lifecycle, while humans remain accountable for risk decisions, exceptions, and production safety. Security and IT must share the outcome through clear decision rights, reliable handoffs, and feedback when automation or ownership breaks down.

The organizations that adapt will stop treating every vulnerability as a fire drill and start operating remediation as an engineered system: continuously discovering, prioritizing, routing, fixing, verifying, and learning. That is the shift AI is forcing. The vulnerability may be new; the strategic question is whether the organization can respond at the speed the new environment demands.

Joel Bruesch is Chief Information Security Officer for BMC Helix, a CISSP, and a 27-year cybersecurity veteran leading a cybersecurity organization. His career has placed him on the front lines of vulnerability management, cyber defense, threat intelligence, security operations, and incident response. That experience has reinforced a simple reality: organizations cannot prevent every vulnerability or cyber event, but they can determine how prepared they are to identify, prioritize, and respond to risk when it emerges.

Sources

Google Threat Intelligence Group, “2025 Zero-Day Review”

CNBC, coverage of Dario Amodei’s remarks on Mythos

Anthropic, “Mythos: A new frontier for AI-assisted vulnerability research”