The Vulnerability Gap: Why Discovery Is Outrunning Repair

Ah, marvellous. Dark Reading has identified what it calls "the vulnerability gap": advanced AI models now knock out vulnerability reports in hours, while patching, disclosure coordination and upstream maintenance loaf along at roughly the same speed as a council recycling collection. So the machines have learned to find every open window in the house, and we have responded by scheduling a surveyor to visit next quarter. This is the cybersecurity equivalent of a fire alarm that can detect smoke instantly but whose sprinklers require a paper-based approval process.

The asymmetry is almost comical if you're not the one whose infrastructure is the target. Discovery is now a matter of hours; repair remains a matter of weeks, months, or as long as the vendor's support contract can stretch it. The entire security industry has built its business model on the assumption that finding a bug is the hard part; now that an LLM can do it before you've finished your first coffee, the hard part has become convincing anyone to fix it. Dark Reading frames this as a "gap", which is rather like calling Titanic's missing lifeboats a "capacity planning opportunity". AI didn't just speed up the finding of flaws — it exposed that the entire patch-to-patch ecosystem, from responsible disclosure to upstream maintenance, is still running on whatever clock was fashionable in 2003.

None of this will be fixed by asking the AI models to be "responsible", because the models are busy being useful, and the humans are busy being organisations. Upstream maintenance hasn't sped up, disclosure coordination hasn't sped up, and there is no sign anyone in charge thinks the imbalance is anything other than a topic for a working group. Still, on the bright side, if your attackers can identify a critical vuln in hours while your vendor patched it after three change-control board meetings, at least the breach will be well documented.