Topic starter
01/08/2026 10:43 pm
TL;DR: Anthropic’s Project Glasswing found more than 10,000 high- or critical-severity vulnerabilities across roughly 50 partner organisations in 30 days, while its scanning of 1,000 open-source projects added about 6,200 more findings, highlighting a discovery rate that current remediation workflows cannot absorb, according to Cogent. The governance problem is no longer detection alone, but whether vulnerability programmes can triage, validate, and remediate at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Cogent: “Glasswing's First Month: 10,000 Critical Vulnerabilities and a Preview of What's Coming”.
Key questions
Q: What breaks when vulnerability discovery outpaces remediation capacity?
A: When discovery moves faster than validation and patching, the backlog becomes the control failure.
Q: Why do AI-generated vulnerability findings create audit and compliance risk?
A: Because auditors look for evidence of a controlled process, not just a list of issues.
Q: How do security teams know whether their vulnerability programme is keeping up?
A: Look for measurable reductions in time from disclosure to validated remediation, fewer exceptions on internet-facing assets, and faster containment when active exploitation appears.
Practitioner guidance
- Automate exposure triage Map new findings against live asset inventory, software ownership, and criticality so teams can prioritise what is actually reachable and business-relevant.
- Shorten privileged remediation paths Pre-authorise routine remediation workflows that require elevated access, so fixes do not stall behind avoidable approval chains.
- Separate validation from execution Use rapid validation steps to confirm exploitability and impact before routing issues into standard change and patch workflows.
Bottom line: AI-assisted discovery is increasing the volume of critical findings faster than many security teams can process them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:53 pm
Machine-speed discovery exposes a governance speed mismatch: the issue is no longer whether organisations can identify vulnerabilities, but whether remediation authority can keep up with automated discovery. When finding defects becomes cheap and fast, the control plane shifts to triage quality, change approval, and execution speed. That means vulnerability governance must be designed as a throughput system, not a reporting function.
A question worth separating out:
Q: What should organisations change first when vulnerability volume exceeds manual capacity?
A: Start by automating triage and inventory matching before trying to automate every fix. If teams cannot rapidly identify which assets are affected and who owns them, remediation automation just speeds up confusion. Once exposure mapping is reliable, organisations can pre-authorise recurring fixes, route routine changes through controlled workflows, and reserve human review for genuinely high-risk cases.
👉 Read our full editorial: AI-driven vulnerability discovery is outpacing manual remediation