![\"\"\/](\"https:\/\/federalnewsnetwork.com\/wp-content\/uploads\/2026\/07\/Doug-Britton-headshot.webp\")
<\/a><\/p>\n Doug Britton<\/a><\/p>\n \n July 17, 2026 4:17 pm <\/p>\n 3 min read<\/p>\n The cybersecurity industry is betting heavily on artificial intelligence. The idea is that if we can use AI to find vulnerabilities faster, software will be more secure, and organizations can stay ahead of bad actors.<\/p>\n However, in most organizations, vulnerability discovery is not what\u2019s holding security teams back. Remediation is. Teams are already drowning in more common vulnerabilities and exposures (CVEs) than they can prioritize and address. According to Verizon\u2019s 2026 Data Breach Investigations Report<\/a>, one of the most common breach vectors is the exploitation of known vulnerabilities. Vulnerabilities exist, but because patching is difficult and requires significant resources, organizations often fall behind in fixing them in a timely manner.<\/p>\n Now, we\u2019re seeing AI models dramatically accelerate the discovery of vulnerabilities, putting unrelenting strain on already overwhelmed cybersecurity teams.<\/p>\n In April, Anthropic announced<\/a> Claude Mythos Preview, an AI model that discovered thousands of bugs in major operating systems and browsers, many of which had gone undetected for decades.<\/p>\n ]]><\/p>\n Following the announcement, the U.S. administration warned<\/a> that what\u2019s coming next is an \u201cavalanche\u201d of vulnerabilities. Those new vulnerabilities will just pile up on top of the existing ones.<\/p>\n The backlog will continue to grow as the window between discovery and remediation stretches wider. The pool of exploitable vulnerabilities available to attackers will get larger.<\/p>\n This is the dynamic missing from most of the current AI-in-security conversation. The industry is investing heavily in finding problems faster without any proportional investment in the capacity to fix them. That asymmetry has consequences.<\/p>\n A growing body of known-but-unpatched vulnerabilities is an opportunity for adversaries to exploit defenders stuck in permanent triage. More visibility, under those conditions, doesn\u2019t translate to more security. It translates to more pressure on teams that are already stretched.<\/p>\n The industry\u2019s answer so far has focused on faster scanning, better detection and smarter prioritization. All of these are important steps, but the reality is that remediation doesn\u2019t scale at the same rate as discovery. Addressing that gap is the actual problem, and the best way to keep cyber defenses from becoming overwhelmed.<\/p>\n This leaves us with one path that hasn\u2019t gotten nearly enough attention: reducing the impact of vulnerabilities that can\u2019t be fixed immediately. It\u2019s not a substitute for patching, but a complement to it. By limiting the exploitability of entire vulnerability classes, organizations can contain risk even when remediation is weeks or months away.<\/p>\n This model already exists in industrial systems and embedded platforms, environments where patching is difficult or impossible. For example, Microsoft\u2019s Security Response Center<\/a>, which triages every reported Microsoft security vulnerability,\u00a0found that approximately 70% of the vulnerabilities<\/a>\u00a0assigned a CVE each year were memory safety issues. Additionally, the\u00a0Google Security Blog<\/a>\u00a0regularly publishes articles on their progress toward memory safety, with memory safety vulnerabilities in Android once accounting for 76%.<\/p>\n ]]><\/p>\n AI is finding vulnerabilities faster, whether the industry is ready for it or not. Mitigation is the only way for defenders to regain control.<\/p>\n Doug Britton is executive vice president and chief strategy officer of RunSafe Security.<\/p>\n Copyright
\n \u00a9\u00a02026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.\n <\/p>\n","protected":false},"excerpt":{"rendered":"AI is finding vulnerabilities faster, whether the industry is ready for it or not. Mitigation is the only…\n","protected":false},"author":2,"featured_media":109974,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[24,53,25,182,24181,56642,353,34801],"class_list":["post-109973","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ai","tag-ai","tag-anthropic","tag-artificial-intelligence","tag-claude","tag-common-vulnerabilities-and-exposures","tag-doug-britton","tag-mythos","tag-runsafe-security"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/109973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=109973"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/109973\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/109974"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=109973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=109973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=109973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}