Experts debate whether VulnOps can match AI-found flaws
Original title: What will it take to make VulnOps a reality?
CSA and SANS are building the model, but practitioners disagree on how much human oversight can remain.
About a year after Heather Adkins, Gadi Evron and Bruce Schneier proposed VulnOps, the Cloud Security Alliance has an operating model and SANS has published guidance and plans training. Evron says spending on finding vulnerabilities outpaces what organizations can do after discovery. Mogull and Skoudis describe continuous, AI-centric workflows with governance limits, while Chris Elgee calls the idea a rebrand. Evron says human-in-the-loop cannot keep pace.
Unconfirmed: Experts disagree on whether VulnOps is a new discipline and whether human oversight can remain.
- Evron is CEO of Knostic; Rich Mogull is CSA chief analyst.
- Skoudis favors governance-in-the-loop rather than full automation.
- Mogull says remediation is nowhere near fully automated.
- Ali Khan of Iru warns patches can break legacy business processes.
- Organizations
- Cloud Security AllianceSANSKnosticIru
From the original article
7 min read at csoonline.com
Just over a year ago, before advanced AI models began discovering software vulnerabilities at a nearly unmanageable scale in the so-called vulnpocalypse, three industry experts pioneered the concept of “VulnOps.”
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.