AI is fundamentally changing the vulnerability management equation. AI models can discover software flaws faster than ever, generate potential exploits and help developers remediate vulnerabilities in code that previously required extensive human analysis. But as the gap between vulnerability discovery and exploitation shrinks, traditional security processes are struggling to keep pace.
Organizations must move beyond counting vulnerabilities and adopt a more dynamic, exposure-focused approach to security, said analysts in the “Mythos: Breaking Out of the Vulnerability Matrix” session at Forrester’s Security & Risk Forum this week in Washington, D.C. They'll need to rethink how teams validate risk, prioritize remediation, deploy AI and measure security effectiveness while recognizing that human oversight remains essential.
"AI changes not only how we set up our programs, but how to respond, and what the capabilities are for the attackers,” said Janet Worthington, senior analyst at Forrester.
From vulnerability counts to exposure management
Traditional vulnerability management metrics are becoming less meaningful, according to Worthington.
“We really have to change,” she said. “In the past … we spent a lot of time counting vulnerabilities, being very proud that we could give those numbers to the executives. Because AI is accelerating, both discovery and exploitation, we really need to talk in terms of exposure now.”
Historically, security teams had time between a vulnerability's disclosure and its exploitation to assess risk, prioritize remediation and deploy patches. AI is compressing that window. Conference speakers noted that vulnerabilities can now be exploited before they're publicly disclosed, leaving organizations with fewer opportunities to respond.
The volume of reported vulnerabilities is also increasing. “Last year, we found 48,000 [vulnerabilities] that ended up on the CVE list," Worthington said, referring to the Common Vulnerabilities and Exposures list put out by the Department of Homeland Security. "This year's projected to be over 100,000.”
Forrester senior analyst Erik Nost countered, “But volume does not equate to exploitable risks. Just because they're CVEs doesn't mean they're reachable. It doesn't mean that they're exploitable in your environment.”
Instead of focusing on the number of vulnerabilities identified or remediated, security leaders should measure exposure, what systems and data are at risk, whether existing controls prevent exploitation and whether remediation has meaningfully reduced risk.
This requires continuous exposure validation rather than relying exclusively on periodic scans and traditional severity ratings.
The remediation trust gap
AI is giving application security teams capabilities that were previously difficult or impractical to scale. Models can analyze large codebases, identify complex vulnerabilities and provide developers with suggested fixes.
Historically, automated remediation worked best for relatively straightforward problems, such as updating vulnerable third-party libraries. Fixing vulnerabilities in proprietary code required a deeper understanding of application functionality, architecture and business context. AI can help supply that context and generate code changes. However, organizations shouldn't assume that AI-generated fixes are safe to deploy automatically.
“We don't trust AI [for remediation],” Nost said, citing studies in which different models were run across 600 vulnerabilities. “We found that AI only fixed the vulnerability without breaking the application and without introducing a new vulnerability only 26% of the time. So, we still have a lot to overcome to gain confidence from AI scaling and automating to letting it fix our code.”
AI agents can recommend fixes and automate portions of remediation workflows, including creating tickets and suggesting changes. But safely implementing changes requires detailed knowledge of application behavior, infrastructure, dependencies, business priorities and potential operational consequences. A seemingly straightforward fix could disrupt customer access, interrupt revenue-generating services or introduce new vulnerabilities.
Speakers at the conference session identified the following considerations for deciding when AI-assisted remediation is appropriate:
- Complexity. Novel vulnerabilities and unfamiliar environments warrant additional human review.
- Business impact. Changes affecting availability, customers or revenue should involve human decision-makers.
- Accountability. Security teams shouldn't bypass established development ownership and responsibility simply because AI can generate code fixes.
- Context. Teams need evidence of potential consequences, including the scope of exposure and the blast radius of proposed changes.
The longer-term direction might include increasingly autonomous remediation for well-understood, low-risk changes, with approval mechanisms and rollback capabilities. Human beings should always be the default for consequential decisions.
Three priorities for security leaders
Forrester analysts outlined the following three capabilities organizations should prioritize as AI reshapes security operations:
- AI red teaming. Businesses developing AI agents and engineering systems should test them against adversarial behavior. Human-led testing remains important for identifying unexpected ways attackers might manipulate models, agents and their associated tools.
- Exposure validation. Security teams need capabilities that establish whether vulnerabilities are reachable and exploitable in their specific environments. This helps distinguish theoretical weaknesses from exposures that represent actual business risk.
- Agentic development security. As developers increasingly use coding agents, security teams must address the risks the agents themselves introduce. These include insecure code generation, vulnerable dependencies, exposed secrets, malicious instructions and risks associated with Model Context Protocol integrations and other agent extensions.
The speakers also recommended prioritizing critical applications, reducing unnecessary attack surface, strengthening software development pipelines and investing in developer security champions who can bring security expertise into engineering teams.
AI doesn't eliminate the need for established security fundamentals, but it changes the speed and scale at which organizations must apply them. Security leaders who combine AI-driven discovery, continuous exposure validation, contextual remediation and human accountability will be better positioned to manage the risks ahead.
Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston's professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyberstrategy for military and government audiences.
