Blog

Security teams have never been busier. Dashboards are full of activity – patch counts climbing, remediation tickets being closed week after week. On paper, organisations are doing the work. And yet the teams running these processes will....

Your team found 5,000 vulnerabilities last quarter. How many did you actually fix? If the answer makes you slightly uncomfortable, you're in good company. And it's not because your team lacks competence or tools. It's because the way most organizations approach vulnerability management was never designed for the reality we're facing today. Here's what keeps me up at night: vulnerabilities aren't just one threat vector among many. They are the primary way attackers get in. Yes, social engineering plays a role, but exploiting vulnerabilities is how the vast majority of successful breaches actually happen. And here's the part that should bother every security leader, most of these breaches rely on vulnerabilities that have been publicly known for years. Not zero-days. Not sophisticated nation-state exploits. Known, unpatched weaknesses that we simply haven't gotten around to fixing. So if we all know this, why are we still drowning?

You just got an alert about a critical vulnerability. CVSS 9.8. Sounds urgent, right? But here's the question that actually matters: Is that vulnerability on an internet-facing production server handling customer data, or is it on an air-gapped test machine that gets rebuilt every week? If you can't answer that question in seconds, you have an asset inventory problem. And that problem is affecting every security decision you make.

A tale of two forces — and why neither cancels the other out. This week, Anthropic launched Claude Code Security, an AI tool that autonomously scans entire codebases for vulnerabilities, suggests human-reviewed fixes, and reportedly uncovered 500+ high-severity vulnerabilities in production open-source projects during internal testing, some of which had gone unnoticed for years. The reaction was immediate. CrowdStrike and Cloudflare dropped 8%. A total of $15 billion was erased from cybersecurity stocks in a single session on February 20th. Markets interpreted the launch as a disruption signal: if AI can replace vulnerability scanners, what happens to the industry?But that reading misses the real story and the real risk.

Traditional vulnerability management has been designed for a world of steady streams - patch cycles, database updates, and predictable timelines. Processes are built to handle a steady stream of new CVEs to patch. But every day now...

Security teams are scrambling to keep up with the ever-greater volume and sophistication of threats, with the active and continual exploitation of CVEs (Common Vulnerabilities and Exposures) having become the source of major headaches.