Experts debate whether VulnOps can match AI-found flaws
CSA and SANS are building the model, but practitioners disagree on how much human oversight can remain.
Stories per day · 30 days
13 RSS
Relatedcisa5kev5ciso3patch-management3rapid73burnout2cvss2exploitation2fortune-cyber-602mythos2nodezero2patch-tuesday2pentesting2qualys2remediation2sbom2survey2vex2
129 stories, newest first · one card per story
Stories tagged #vulnerability-management
Nearly half of large firms close unverified vulnerability findings
Most large enterprises hold more than 1,000 untriaged findings, and about a quarter exceed 10,000.
Friedman says SBOMs matter for response, not static inventories
He argues accurate supplier SBOMs speed Log4j-style response, while VEX separates vulnerable components from exploitable ones.
CISA BOD 26-04 tells agencies to prioritize patches by risk
Timelines depend on internet access, known exploitation, whether exploitation can be automated, and attacker control.
.jpg&w=828&q=75)
Gartner says AI is closing attack paths faster than patching
Rapid7 is offering free access to the May 28, 2026 Gartner report and tying it to its own exposure-management pitch.
1
Cogent Security Makes Fortune Cyber 60 for a Second Year
Cogent's AI closes vulnerability response gaps shown by PHP2Shell, where attackers exploited before patches and Fortune 500 companies patched less than 1% of 2,266 assets.
1
Pentest remediation workflow ranks findings with CVSS, EPSS and impact
A June 2026 survey of 158 practitioners found 68.4% would be strained by 500 or more candidate findings.
Horizon3 says old vulnerability habits still undermine CTEM
Customer retests cut demonstrated compromise to zero while dozens of minor findings remained.
1
Qualys CISO urges tracking exposure window over MTTR
Qualys TRU says 357 of 48,172 flaws disclosed in 2025 were remotely exploitable and weaponized.
1
Bellini Capital CISO says faster patching cannot close AI exposure
Brian Blakley argues attackers turn flaws into exploits faster than defenders can test, approve, and schedule patches.
Horizon3 sends NodeZero findings into Palo Alto Cortex XSOAR
High and critical findings become XSOAR incidents, and 1-Click Verify retests whether a fix is still exploitable.
1
Cybersecurity job openings listed for October 27, 2026
Roles span penetration testing, cloud networking, ISSO compliance and SOC 2 work across eight countries.
1
Tenable outlines detection and patching for PHP2Shell
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
Rapid7: high-severity flaws exploited three days after disclosure
Of 43 newly exploited high- and critical-severity bugs in Q3, 34 needed no authentication or user interaction.
1
Opinion: security needs machine-speed AI, not detection alone
The author says CyberGym tests found high bug-discovery accuracy but poor, often refused, automated remediation.
1
DevGuard open-source platform ranks and tracks supply-chain findings
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
Known exploited flaws take a median 87 days to patch, Moody's says
Flaws without known exploitation take 107 days at the median, using February 2026 Bitsight data.
1
Analyst says vulnerability volume is crowding out resilience
CISA has published over 67,000 CVEs and anticipates about 96,000 new vulnerabilities by year-end.
2
How Multi-Campus Universities can Build a more Connected Security Program
Rapid7 says multi-campus universities should share security visibility and response while keeping campus data separate.
2
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
Vulnerability Management Isn't About the Score — It's About How It Applies to You
Dark Reading argues vulnerability management should use environment-specific exploit evidence, not vendor scores.
3
Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
Bank of America hired 1,000 contractors to patch Anthropic Mythos findings amid large AML penalties.
2
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added actively exploited Atlassian flaw CVE-2026-21589, which exposes files to external parties, to the KEV catalog.
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps
SOCRadar released Splunk apps for MSSP incidents and vulnerability management, expanding its Splunkbase catalog to five apps.