At this 12 months’s RSA Convention, I moderated a panel on GenAI code safety that surfaced an uncomfortable reality. As one panelist, Dave Aitel from OpenAI, put it bluntly: “We’re seeing an enormous forest fireplace of all this technical debt coming due abruptly.” He’s proper. We’re in what could possibly be referred to as the vulnpocalypse, the place many years of gathered safety debt are colliding head-on with AI-accelerated code technology.
Right here’s the half no person desires to confess. Builders have by no means absolutely understood all of the code they ship. AI didn’t create that drawback. What it did was compress years of technical debt discovery into months, forcing firms to lastly take care of points they’ve ignored for years.
Vibe Coding Meets Actuality
We’ve jumped from AI code completion to full “vibe coding” in document time. That’s the workflow the place you could have an concept, write a immediate, and settle for regardless of the AI generates. In the course of the RSAC panel, Dave admitted he’s shipped main options in Rust regardless of by no means writing a single line of Rust himself.
That sounds reckless till you notice the actual query. Do organizations have the infrastructure to handle code when understanding is break up between people and machines?
A transparent sample is rising. The organizations doing nicely with AI growth aren’t those with the fanciest instruments. They’re those who already had their act collectively. As panelist Daniel Miessler, who runs AI safety firm Unsupervised Studying, put it, in case your engineering practices are “a soup sandwich,” AI gained’t repair that. You’re simply making the mess quicker.
The winners already mapped their parts, documented their processes, and understood their techniques earlier than AI confirmed up. Now they’re including AI to a strong basis and getting actual productiveness positive aspects. Everybody else is including pace to chaos.
The Management We By no means Had
One level from the panel has caught with me. Possibly organizations by no means had full management to start with. Give it some thought. Even earlier than AI, how a lot of a whole codebase might any single developer clarify? They knew their piece and perhaps their workforce’s work, however the entire system? No probability.
AI offers us higher instruments to know what’s been constructed. You’ll be able to ask your codebase questions now and get immediate documentation. The tradeoff is that all the things strikes quicker.
Kelly Shortridge from Fastly made the essential level in the course of the panel that software program doesn’t exist in a vacuum however is a sociotechnical system. Engineers want to speak to one another, construct shared understanding, and work collectively when issues break. The true hazard is that AI erodes the collaborative data that retains techniques working throughout a disaster.
Why Conventional Remediation Can’t Hold Up
For years, the usual strategy to vulnerability remediation labored nicely sufficient. Type vulnerabilities by CVSS rating, repair the crucial ones first, work your manner down. That technique assumed a comparatively steady charge of recent vulnerabilities.
That assumption is useless. Our 2026 State of Software program Safety analysis discovered that 82% of organizations now carry safety debt, up from 74% only a 12 months in the past.
When organizations create vulnerabilities quicker than they’ll repair them, prioritization turns into pointless. You’re bailing water from a ship whereas the outlet will get greater. Sooner or later, arguing about bucket dimension is absurd.
The panel revealed one thing vital. Organizations dealing with remediation nicely made their investments earlier than the disaster hit. They constructed safety into their growth workflows years in the past as a substitute of bolting it on on the finish. When safety testing runs within the IDE and provides builders speedy suggestions, vulnerabilities get mounted in minutes. That stops debt from piling up within the first place.
These firms additionally stopped treating Widespread Vulnerability Scoring System (CVSS) measurements as gospel. A excessive severity bug in unreachable code issues lower than a medium severity difficulty in your authentication move. The delicate groups map vulnerabilities to precise danger primarily based on whether or not attackers can attain them and exploit them.
What Expertise Leaders Ought to Do Now
We have been requested in the course of the panel whether or not enterprises want AI protection to counter AI-driven growth. The reply isn’t that organizations want robots preventing robots. They want strong engineering practices. They’ve all the time wanted them. The distinction is, they simply want them proper now.
Right here’s the crucial query for know-how leaders. How lengthy wouldn’t it take your workforce to repair each crucial vulnerability throughout your functions? In the event you assume months or years, you’re already underwater. The vulnpocalypse isn’t approaching. You’re in it.
Begin with trustworthy measurement. Rely your recognized vulnerabilities, but additionally monitor how briskly you’re introducing new ones. If that charge is climbing (and for many firms, it’s) your total remediation strategy wants to vary.
Then construct what the RSAC panelists referred to as “layers of protection.” Automate what you’ll be able to. Add integration testing to catch issues AI-generated code may create. And be sure to have clear possession, so AI doesn’t grow to be the excuse when one thing breaks.
The businesses that repair this now would be the ones nonetheless standing when the vulnpocalypse shakes out. They’ll flip safety from a bottleneck into a bonus that lets them transfer quicker.
