Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: Anthropic’s Project Glasswing found more than 10,000 high- or critical-severity vulnerabilities across roughly 50 partner organisations in 30 days, while its scanning of 1,000 open-source projects added about 6,200 more findings, highlighting a discovery rate that current remediation workflows cannot absorb, according to Cogent. The governance problem is no longer detection alone, but whether vulnerability programmes can triage, validate, and remediate at machine speed.
NHIMG editorial — based on content published by Cogent: Security Glasswing's First Month and the coming vulnerability surge
By the numbers:
- The average enterprise takes over 60 days to close a critical vulnerability.
- 62% of critical vulnerabilities with a known exploit had that exploit circulating before any scanner released a detection signature.
Questions worth separating out
Q: How should security teams handle vulnerability backlogs when discovery outpaces remediation?
A: Security teams should treat backlog growth as a capacity problem, not just a prioritisation problem.
Q: Why do AI-driven vulnerability findings create more operational risk for large programmes?
A: They increase risk because large programmes already have longer approval paths, more dependencies, and more systems that must change together.
Q: What breaks when vulnerability management is limited to scan results?
A: Teams end up triaging large numbers of findings without knowing which ones can be chained into a working attack.
Practitioner guidance
- Measure remediation throughput, not just vulnerability counts Track how many critical findings are validated, assigned, and closed per week, then compare that rate to the incoming discovery rate.
- Add software inventory context before scanner dependence Correlate findings with authoritative asset and application inventory so exposure can be assessed even when scanner signatures lag or never arrive.
- Define policy-based autonomous remediation zones Pre-authorise low-risk fixes that can execute through standard change controls, while routing ambiguous changes through human approval.
What's in the full article
Cogent's full article covers the operational detail this post intentionally leaves for the source:
- Month-by-month comparison of AI-assisted findings against historical CVE issuance patterns
- Partner-specific examples showing how different software environments produced large critical vulnerability counts
- Discussion of scanner lag and why signature-based detection misses newly disclosed issues
- Cogent's view of how Zero Day Response and Autonomous Remediation change the remediation lifecycle
👉 Read Cogent's analysis of AI-driven vulnerability discovery and remediation backlog risk →
AI-driven vulnerability discovery is outpacing remediation queues?
Explore further
01/08/2026 10:53 pm
AI-driven vulnerability discovery is creating remediation debt faster than most programmes can retire it. When one month of frontier-model scanning produces thousands of critical findings, the issue is no longer whether teams can see risk. The issue is whether their operating model can turn that visibility into closure before backlogs become structural. This is a governance problem as much as a security one, because the organisation must assign ownership, risk thresholds, and exception handling at a pace traditional ticketing cannot sustain. Practitioners should treat discovery volume as an operational capacity metric, not just a technical metric.
A question worth separating out:
Q: Should organisations automate remediation or keep it manual?
A: Start with automated triage and low-risk fixes, then reserve manual review for high-impact exceptions. Automation is most useful when it removes unused access, highlights policy violations, and shortens time to action, but humans still need to decide on edge cases where business context changes the risk.
👉 Read our full editorial: AI-driven vulnerability discovery is outpacing manual remediation
