Notifications
Clear all
Topic starter
18/08/2026 2:13 pm
TL;DR: AI is turning vulnerability discovery into a continuous, machine-speed process, widening the gap between how quickly weaknesses surface and how slowly most teams remediate them, according to Ory. The practical implication is that patch-cycle thinking is no longer sufficient when discovery accelerates faster than human response.
NHIMG editorial — based on content published by Ory: The New Arms Race: AI Just Picked a Side... Both Sides Attackers need one crack; defenders must cover every wall
Questions worth separating out
A: They should shift from point-in-time vulnerability handling to continuous exposure reduction.
Q: When does AI-assisted vulnerability discovery become a business risk?
A: It becomes a business risk when discovery outpaces remediation, especially in systems that handle credentials, tokens, or privileged access.
Q: What do security teams get wrong about quarterly patch cycles?
A: They treat quarterly patching as a stable governance rhythm even when discovery is now continuous.
Practitioner guidance
- Prioritise exploit-window remediation Rank vulnerabilities by how quickly they can be discovered and abused, then shorten the change path for issues that expose credentials, tokens, or auth flows.
- Move to continuous exposure monitoring Replace reliance on quarterly scan-and-fix cycles with continuous monitoring for high-risk code paths, dependencies, and externally reachable services.
- Treat identity-bearing assets as highest risk Escalate service accounts, API keys, delegated tokens, and privileged integrations ahead of general application defects when scheduling remediation.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- A closer look at how AI changes vulnerability discovery cadence across modern codebases and bounty programmes
- The article's reasoning on why quarterly patch cycles no longer match attacker discovery speed
- The practical implications for teams trying to keep pace with continuous scanning and remediation
- The source's own commentary on what security leaders should change in their operating rhythm
👉 Read Ory's analysis of how AI is accelerating zero-day discovery →
AI-driven zero-day discovery: are patch cycles still enough?
Explore further
18/08/2026 3:05 pm
Machine-speed discovery has created a new governance gap: remediation latency. The article is right to focus on the asymmetry between attacker discovery and defender response, but the governance issue is not simply patch volume. It is the delay between identifying a weakness and removing its operational value. When scanning, approval, and deployment all move slower than discovery, exposure becomes a timing problem rather than a pure hygiene problem. Practitioners should treat latency as a first-class control failure.
A question worth separating out:
Q: How can IAM teams reduce the risk of reusable secrets?
A: Reduce reuse by shortening secret lifetimes, binding credentials to context, and limiting where they can be presented. The goal is to make a stolen secret less useful outside its original system or device. That approach matters for both human authentication and NHI governance.
👉 Read our full editorial: AI speeds up zero-day discovery and breaks patch-cycle defense
