Summary
- Microsoft issued over 970 patches in a single week, contributing to what feels like an unrelenting patch burden for security teams.
- Gartner research VP Craig Lawson believes AI vulnerability-discovery tools like Anthropic’s Mythos may be approaching exhaustion of flaws in established, mature codebases.
- Lawson argues the current high CVE count is a positive signal — not a worsening threat landscape, but a long-overdue audit of technical debt.
- He predicts 2027 could see the first net drop in vulnerability severity as old codebases are cleaned up and AI-assisted development tightens new releases.
- AI may also democratise red-teaming and accelerate remediation, shifting security operations from a reactive ticket queue to a measurable risk-reduction function.
A record patch week, read differently
When Microsoft delivered more than 970 patches in a single week, the immediate reaction from most security professionals was predictable: more work, more triage, more risk exposure during the window between disclosure and deployment. That reading is understandable. But Gartner research vice president Craig Lawson, speaking at Gartner’s IT Symposium in Australia, offered a different interpretation — one that deserves serious consideration.
The codebase audit hypothesis
Lawson’s argument hinges on what AI-powered vulnerability discovery tools are actually doing to mature codebases. Tools like Anthropic’s Mythos are capable of auditing code at a scale and depth that has never previously been possible. “We’ve never had a situation where massive codebases have been audited to that level before,” Lawson told The Register. The implication is that what looks like an explosion in vulnerability counts is, at least partly, the surfacing of flaws that have existed for years or decades — simply undetected.
OpenBSD as a case study
Lawson pointed to a recent series of CVEs found in OpenBSD as illustrative evidence. OpenBSD has historically been among the most security-conscious and stable operating systems available. The fact that AI bug-hunters are finding meaningful flaws there suggests these tools are not just picking off low-hanging fruit — they are working through code that experienced human reviewers had previously cleared. Security vendors, who presumably understand secure development better than most, are also using AI to find flaws in their own products, Lawson noted. He interpreted those disclosures as further evidence that AI is eliminating potential zero-day attack surface before adversaries can exploit it.
Why 2027 might look different
Lawson’s thesis leads to a specific prediction: the current period of high CVE volume is approaching a natural ceiling. As established codebases are exhausted of discoverable flaws, and as AI is incorporated into development pipelines to catch vulnerabilities in new code earlier, the volume — and particularly the severity — of disclosures should begin to fall. “2027 could be the first year we see a net drop, maybe not in aggregate vulnerabilities, but definitely in severity of flaws,” he told The Register. This is not a guarantee, and Lawson acknowledged it as a directional forecast rather than a certainty. Importantly, no corroborating data from independent sources was available at the time of publication.
Operational implications: red-teaming and remediation
Beyond the macro-level vulnerability trend, Lawson outlined two operational shifts worth attention. First, AI bug-hunters could fundamentally change the economics of red-teaming. Today, a red-team exercise is typically an infrequent, expensive engagement involving external specialists. AI tooling could, in Lawson’s view, enable organisations to run an effective red team continuously — shifting adversarial testing from a periodic snapshot to an ongoing capability. Second, when vulnerabilities or misconfigurations are identified, AI could dramatically compress the time needed to develop fixes. Lawson offered a practical illustration: using a large language model to generate configuration syntax — an F5 iRule, for example — as a virtual patch, bringing that capability to analysts who may not have deep specialist knowledge in every platform they manage.
Rethinking how security teams measure success
Lawson also made a point that goes beyond tooling. Security operations centres today typically measure staff performance by ticket volume — how many vulnerabilities were triaged and closed. Lawson argued this metric misrepresents the value security teams deliver. A better framing, in his view, is to recognise and communicate the outcomes that defensive work produces: keeping a hospital operational, stopping a ransomware event from completing. For CISOs making the case for investment or headcount, this reframing has obvious strategic value.
Why it matters
CISOs are currently managing patch fatigue at scale, and the instinct is to treat rising CVE counts as evidence of a worsening environment. Lawson’s analysis inverts that assumption and suggests the current burden may be temporary and structurally self-limiting. If the hypothesis holds, security leaders who invest now in AI-assisted remediation and continuous adversarial testing stand to gain disproportionate efficiency as the volume of novel, high-severity vulnerabilities begins to level off. The more immediate operational point is that AI tooling is already changing what is achievable in vulnerability management and red-teaming — regardless of how the macro trend unfolds.
What to do now
- Assess whether your current AI-assisted vulnerability discovery tools are being applied to legacy and mature codebases, not just new development, given that this is where the current disclosure surge appears to be concentrated.
- Evaluate the business case for continuous AI-assisted red-teaming as an alternative or supplement to periodic external engagements, based on Lawson’s observation that this capability is becoming more accessible.
- Explore large language model tooling for remediation acceleration — particularly for generating configuration-level virtual patches in environments where specialist knowledge is stretched thin.
- Review how your security operations centre measures and reports performance, and consider shifting from ticket-count metrics toward outcome-based reporting that reflects risk reduced or incidents prevented.
- Monitor CVE severity trends through 2026 and into 2027 as a leading indicator of whether the codebase-exhaustion thesis is playing out, and factor this into multi-year resource planning.
