Finding bugs just became the cheap part.
The expensive part did not get cheaper. It got longer.
This month Microsoft patched 966 flaws in a single release, one of the largest monthly batches the company has ever shipped, including two that attackers were already exploiting in the wild.
Microsoft has said publicly that it now runs agentic scanning systems across its own Windows codebase to find weaknesses faster. That is the discovery half of security being industrialised.
CrowdStrike's 2026 Global Threat Report shows the same curve on the attack side: an 89% increase in attacks run by AI enabled adversaries, and a 42% rise in flaws exploited before anyone had disclosed them publicly.
More bugs found, faster. More bugs used, faster. Both of those things are true at the same time.
The number nobody puts on the slide
HackerOne published the uncomfortable half of this story. Over a twelve month window, the backlog of unresolved critical severity findings on its platform grew 29 times over.
The resolution rate for critical findings fell from over 85% to under 44%.
Teams did not get worse at their jobs. HackerOne's own reading is that they are fixing the easy things faster while a growing pile of validated, exploitable risk sits untouched. That is the sentence worth sitting with.
Validated. Exploitable. Untouched.
The problem is not that fixes are slow. It is that findings are now free.
When discovery cost real money, volume was a natural brake. Every audit finding and every bounty report represented somebody's budget and somebody's calendar, and that scarcity forced an implicit filter.
That filter is gone now, and most security programs are still shaped around a world where it existed. So teams triage harder, buy another scanner, and open two more roles.
None of it works, because you cannot outrun an exponential intake with a linear increase in attention.
Three changes that actually move the number
1. Measure closures instead of discoveries.
Most security dashboards still celebrate how much was found. That was a fair proxy when finding things was hard. Today it is a measure of how much work you just created. Track resolution rate and open exposure instead, because the number you put on the slide is the number your team will optimise for. If new tooling has shifted the baseline your metrics were built on, this breakdown of how AI is reshaping engineering metrics is a useful place to reset the conversation.
2. Kill vulnerability classes, not instances.
AI will keep finding new instances of the same handful of patterns: a missing authorisation check, an unsafe deserialisation path, an input nobody validated. Fixing instances scales with the size of your backlog. Fixing classes scales toward zero. That means moving the control into the pipeline rather than the pull request, and a short CI/CD pipeline skills check is a reasonable way to find out how ready your team actually is for that shift.
3. Automate the last mile, not the first.
Writing the patch was never the slow part. Proving the fix works, getting it through change management, deploying it, and closing the loop are the slow parts, and none of them got faster. Cheap discovery also created a second queue of duplicates and low quality reports that a person still has to read before anything gets fixed. Automatic validation is now worth more than automatic discovery.
Where this leaves practitioners
The unglamorous truth is that remediation is a throughput problem, and throughput problems are solved with queues, limits, and priorities rather than with enthusiasm.
Cap the intake. Rank by real world exploitation rather than by score alone, and let CISA's Known Exploited Vulnerabilities catalog do the first pass for you. Then protect a fixed slice of engineering capacity for the top of the list, because whatever is not protected will be consumed by whatever arrived most recently.
If the foundation underneath your remediation process is uncertain, a five minute cybersecurity fundamentals check will tell you more about your team's readiness than another scanner licence ever will.
The old model rewarded finding more and fixing more.
The new model rewards finding less of what you cannot fix, and being able to prove what you actually closed.
The teams that adapt will not be the ones with the fastest fixes. They will be the ones whose queue finally stopped growing.
So here is a question worth taking to your next security review. When someone asks how much risk you removed this quarter, what number do you show, and what happens to the conversation when they follow up by asking what is still open?
If you want to build the skills behind that answer rather than just the argument for it, BatchBrain's security engineering roadmaps are a good place to start.
<small>Image credits: conveyor photograph by Lance Cheung, U.S. Department of Agriculture, public domain. Desk paperwork photograph by brendan-c, licensed CC BY 2.0. Postal conveyor photograph by Taylor Slater, U.S. Air Force, public domain.</small>