The AI model is so effective at finding software vulnerabilities that the new constraint is the human capacity to triage, patch, and deploy fixes. This has inverted the problem, creating a surge in demand for security engineers to handle the influx of identified issues.

AI will find vulnerabilities at an unprecedented rate. The real crisis will be the organizational inability to patch them, especially in critical infrastructure with long update cycles and unsupported software where original developers are long gone. The problem shifts from finding flaws to fixing them at scale.

The idea that major software vulnerabilities found by AI can be fixed in a short, coordinated effort is mere "theater." The sheer volume of bugs embedded in decades of code would necessitate a multi-year shutdown of the internet to truly address them, making short-term projects largely performative.

While AI models find vulnerabilities in open-source code, maintainers lack the capacity to review and accept all AI-generated patches. This creates a dangerous situation where exploits are effectively public on GitHub before a fix is widely available, increasing software supply chain risk for thousands of companies.

The plummeting cost of finding exploits via AI models means enterprises cannot simply patch vulnerabilities reactively. The necessary strategic shift is to build foundational security controls for each asset class, including a new, dedicated security layer specifically for the AI stack.

While AI models excel at identifying security vulnerabilities, the next major innovation lies in automatic remediation. The "holy grail" for cybersecurity startups is developing AI systems that can instantly patch and fix identified threats, moving beyond simple detection to proactive, zero-day defense.

AI models are better at finding bad code than writing good code. This capability will rapidly uncover vulnerabilities in open-source, custom, and vendor software that would have otherwise taken 10 years to find. This creates an urgent, large-scale need for patching across all industries.

Advanced AI models capable of finding complex code vulnerabilities are expected to be publicly available within months. This puts enterprises in an urgent race to find and patch their own security holes before malicious actors use the very same tools to exploit them.

The traditional cybersecurity model of humans finding and patching vulnerabilities cannot keep pace with AI that discovers thousands of exploits in hours. This fundamental mismatch in speed and scale will require a complete overhaul of how software security is managed.