Topic starter
25/08/2026 9:13 am
TL;DR: AI-powered vulnerability research is compressing discovery and disclosure from months into days while the CVE database now holds over 354,000 records, according to Nucleus. The real challenge is no longer finding more issues but triaging, normalising, and routing them fast enough that backlog growth does not outrun remediation capacity.
Editorial analysis by NHI Mgmt Group, based on content published by Nucleus: “From AI Findings to Action: How Security Teams Should Triage AI-Discovered Vulnerabilities”.
Key questions
Q: What breaks when AI finds vulnerabilities faster than teams can patch them?
A: The standard vulnerability-management model breaks because it assumes discovery is slower than remediation.
Q: Why do severity scores fail when vulnerability discovery becomes AI-driven?
A: Severity scores fail because they do not capture exposure, business criticality, or identity dependence.
Q: How do security teams keep AI-generated findings from overwhelming remediation workflows?
A: By normalising incoming data, deduplicating repeated issues, and automatically routing validated findings to the correct owners.
Practitioner guidance
- Implement risk-based prioritisation models Rank findings by exposure, exploitability, asset criticality, and business impact, not severity alone, so the queue reflects actual operational risk.
- Normalise all inbound vulnerability data Convert scanner output, advisories, bounty reports, and AI-generated findings into a common schema before analysts review the queue.
- Automate routing to remediation owners Integrate vulnerability intake with ticketing, DevOps, and change workflows so validated findings reach the right team without manual spreadsheet triage.
Bottom line: AI-powered vulnerability research is changing the bottleneck from discovery to triage, routing, and prioritisation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 9:14 am
AI-driven vulnerability discovery is creating triage debt, not just vulnerability volume. The security industry has treated finding more issues as the hard part for a long time, but AI compresses discovery far faster than most organisations can normalise, prioritise, and route them. That means the real failure mode is now decision latency, not detection scarcity. Teams that still rely on manual intake will accumulate backlog faster than they can reduce it, so triage architecture is now part of resilience.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When should organisations rely on automation versus human review in vulnerability triage?
A: Automation should do the first-pass sorting, scoring, and enrichment, while humans handle the hardest cases and validate exceptions. That balance matters because AI can miss environment-specific context or overstate confidence. Human review is still the control that keeps prioritisation honest and auditable.
👉 Read our full editorial: AI vulnerability research is amplifying triage pressure