AI for Vulnerability Management

A weekly Codex Security run on your monorepo identifies a session-handling flaw in your auth service. Because Codex Security validates each finding by attempting reproduction before flagging, the PR it opens is paired with a working PoC and a draft patch. Your engineer's job is review, not triage. OpenAI's first 30-day cohort surfaced 792 critical and 10,561 high-severity findings across 1.2M commits with >50% lower false-positive rate than rule-based SAST.

In April 2026, Anthropic's Claude Mythos autonomously identified CVE-2026-4747 — a remote root RCE in FreeBSD's NFS server, reachable from any unauthenticated network position, that had survived 17 years of human review. Mythos reproduces vulnerabilities into working exploits 83.1% of the time on first try. Defenders learned that age of code is not evidence of safety; attackers learned the same thing. Anthropic withheld broad release because the offensive capability outran defensive readiness.

MOVEit Transfer (CVE-2023-34362, May 2023) was the textbook case: a path traversal, a SQL injection, and an insecure deserialization — none individually catastrophic, none triaged urgently in isolation — chained by Cl0p into a global mass-exfiltration event affecting 2,000+ organizations. Modern AI scanners are starting to surface chains, not just individual bugs; modern prioritization needs to score chains as units, not sum CVSS.

Two services pass independent security review. Each is correct in isolation. A trust assumption in one (a header it accepts as authenticated) doesn't match a trust assumption in the other (a header it sets but doesn't sign). The integration ships, the bug exists, no individual scan finds it. This is the lesson Saltzer & Schroeder articulated in 1975, that DARPA's 2016 Cyber Grand Challenge re-validated when automated patching introduced new flaws, and that AI-driven cross-service scanners are now finding at scale.

Tier-1 SLA (7 days) for CVSS≥7 AND EPSS≥0.7 AND on KEV. Tier-2 (30 days) for everything else above CVSS 7. The backlog quietly shrinks because the team only owes promises on what's actually likely to be exploited — and the prioritization is defensible to auditors and engineering leadership.

Aggressive deprioritization (only patch EPSS>0.5) cuts work ~95% but accepts risk on the long tail when EPSS misses. Most teams stay conservative until the data proves itself in their environment.

A central VM team computes EPSS+CVSS; only the application team knows whether a code path is reachable in their service. Both layers are required and they fail differently when one is missing.

Running deep AI-driven scans (Codex Security, Mythos-class tools where available) on every PR is expensive; nightly is more affordable; weekly leaves a longer attacker window. Pick the budget conversation explicitly.

Auto-patching is the dream and a real risk. Phased rollouts, canaries, and rollback automation matter more than the patch tool itself — and matter more for AI-generated patches than for vendor-supplied ones.

Anthropic withheld Mythos broad release because offensive capability outran defensive readiness. That tradeoff plays out across the ecosystem; defenders depend on coordinated disclosure that's harder to coordinate at machine speed.

Design, build, and maintain security infrastructure. The architects of an organization's defensive posture.

Embed security into the software development lifecycle. Shift left to catch vulnerabilities before they reach production.

Owns the end-to-end find → prioritize → fix → verify loop at scale, now increasingly AI-driven.

External-first role: inventories what an attacker can see, tracks what's new, and drives closure through the org. The outside-in counterpart to vuln management.

Co-creator of EPSS, data scientist at Cyentia Institute

Co-creator of EPSS, researcher at RAND Corporation

Co-founder of Veracode, application security pioneer