Notifications
Clear all
Topic starter
02/08/2026 12:23 pm
TL;DR: Vulnerability management breaks down when scope, sequence, and verification are treated as separate problems rather than one operating system for remediation, according to Cogent’s analysis of SACR’s 2025 Market Guide, with AI-native platforms using entity resolution, traceable evidence, and role-tuned agents to close the loop. The practical shift is away from alert generation and toward governed execution, where identity, ownership, and auditability matter as much as detection accuracy.
NHIMG editorial — based on content published by Cogent: Security Applied AI for Vulnerability Management, based on SACR's 2025 Market Guide
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams use AI without turning it into a control dependency?
A: Security teams should use AI for summarisation, correlation, and prioritisation, then keep containment in deterministic controls such as access policy, segmentation, and revocation.
Q: Why does ownership matter so much in remediation workflows?
A: Because remediation fails when no one can prove who is responsible for each asset, issue, or change.
Q: What breaks when verification is treated as ticket closure?
A: The programme measures activity instead of risk reduction.
Practitioner guidance
- Define a single remediation source of truth Reconcile scanner output, CMDB records, cloud inventory, and ticketing data so every remediation plan points to one asset record and one accountable owner.
- Bind remediation agents to explicit delegated authority Issue narrowly scoped permissions for each security, IT, or application agent, with time limits, approval gates, and rollback paths.
- Require evidence-based closure for every fix Close remediation only when you have asset-level proof that the change landed, the affected control is in place, and the result is attached to the responsible identity and timestamp.
What's in the full article
Cogent's full article covers the operational detail this post intentionally leaves for the source:
- Customer-reported workflow examples showing how AI-native remediation is used in practice.
- The article's own framing of entity resolution, planning, and verification as product capabilities.
- Vendor examples of how operators keep humans in the loop while allowing scoped automation.
- The surrounding market context from SACR's Market Guide that informed the analysis.
👉 Read Cogent's analysis of AI-native vulnerability management in SACR's 2025 Market Guide →
Applied AI in vulnerability management: are legacy scanners falling behind?
Explore further
02/08/2026 1:23 pm
AI-native vulnerability management is really a control-plane problem, not a reporting problem. The article’s three-part framing of scope, sequence, and verification reflects where remediation programmes usually fail: the data is incomplete, the work is not ordered, and the outcome is not proved. That makes the category less about finding more issues and more about governing the change process itself. For practitioners, the implication is that remediation automation must be judged on control quality, not output volume.
A question worth separating out:
Q: Should organisations treat remediation agents like privileged identities?
A: Yes. Any agent that can change assets, update records, or trigger workflows is acting through delegated authority and should be governed accordingly. That means least privilege, scoped access, logging, and review. If an agent can modify production state, it belongs in the same control conversation as other privileged identities.
👉 Read our full editorial: Applied AI for vulnerability management: what Cogent’s market guide implies
