At this 12 months’s RSA Convention, I moderated a panel on GenAI code safety that surfaced an uncomfortable reality. As one panelist, Dave Aitel from OpenAI, put it bluntly: “We’re seeing an enormous forest hearth of all this technical debt coming due all of sudden.” He’s proper. We’re in what could possibly be referred to as the vulnpocalypse, the place many years of collected safety debt are colliding head-on with AI-accelerated code technology.
Right here’s the half no person needs to confess. Builders have by no means absolutely understood all of the code they ship. AI didn’t create that drawback. What it did was compress years of technical debt discovery into months, forcing corporations to lastly cope with points they’ve ignored for years.
Vibe Coding Meets Actuality
We’ve jumped from AI code completion to full “vibe coding” in document time. That’s the workflow the place you’ve got an concept, write a immediate, and settle for regardless of the AI generates. Through the RSAC panel, Dave admitted he’s shipped main options in Rust regardless of by no means writing a single line of Rust himself.
That sounds reckless till you understand the actual query. Do organizations have the infrastructure to handle code when understanding is break up between people and machines?
A transparent sample is rising. The organizations doing nicely with AI growth aren’t those with the fanciest instruments. They’re those who already had their act collectively. As panelist Daniel Miessler, who runs AI safety firm Unsupervised Studying, put it, in case your engineering practices are “a soup sandwich,” AI received’t repair that. You’re simply making the mess quicker.
The winners already mapped their parts, documented their processes, and understood their methods earlier than AI confirmed up. Now they’re including AI to a strong basis and getting actual productiveness positive factors. Everybody else is including pace to chaos.
The Management We By no means Had
One level from the panel has caught with me. Perhaps organizations by no means had full management to start with. Give it some thought. Even earlier than AI, how a lot of a whole codebase may any single developer clarify? They knew their piece and perhaps their workforce’s work, however the entire system? No probability.
AI offers us higher instruments to grasp what’s been constructed. You’ll be able to ask your codebase questions now and get prompt documentation. The tradeoff is that every little thing strikes quicker.
Kelly Shortridge from Fastly made the essential level through the panel that software program doesn’t exist in a vacuum however is a sociotechnical system. Engineers want to speak to one another, construct shared understanding, and work collectively when issues break. The actual hazard is that AI erodes the collaborative data that retains methods operating throughout a disaster.
Why Conventional Remediation Can’t Maintain Up
For years, the usual strategy to vulnerability remediation labored nicely sufficient. Kind vulnerabilities by CVSS rating, repair the important ones first, work your method down. That technique assumed a comparatively steady fee of latest vulnerabilities.
That assumption is lifeless. Our 2026 State of Software program Safety analysis discovered that 82% of organizations now carry safety debt, up from 74% only a 12 months in the past.
When organizations create vulnerabilities quicker than they will repair them, prioritization turns into pointless. You’re bailing water from a ship whereas the opening will get greater. Sooner or later, arguing about bucket measurement is absurd.
The panel revealed one thing necessary. Organizations dealing with remediation nicely made their investments earlier than the disaster hit. They constructed safety into their growth workflows years in the past as an alternative of bolting it on on the finish. When safety testing runs within the IDE and provides builders instant suggestions, vulnerabilities get fastened in minutes. That stops debt from piling up within the first place.
These corporations additionally stopped treating Widespread Vulnerability Scoring System (CVSS) measurements as gospel. A excessive severity bug in unreachable code issues lower than a medium severity difficulty in your authentication move. The subtle groups map vulnerabilities to precise danger primarily based on whether or not attackers can attain them and exploit them.
What Expertise Leaders Ought to Do Now
We have been requested through the panel whether or not enterprises want AI protection to counter AI-driven growth. The reply isn’t that organizations want robots combating robots. They want strong engineering practices. They’ve all the time wanted them. The distinction is, they simply want them proper now.
Right here’s the important query for know-how leaders. How lengthy would it not take your workforce to repair each important vulnerability throughout your functions? For those who suppose months or years, you’re already underwater. The vulnpocalypse isn’t approaching. You’re in it.
Begin with trustworthy measurement. Depend your identified vulnerabilities, but additionally monitor how briskly you’re introducing new ones. If that fee is climbing (and for many corporations, it’s) your total remediation strategy wants to alter.
Then construct what the RSAC panelists referred to as “layers of protection.” Automate what you’ll be able to. Add integration testing to catch issues AI-generated code would possibly create. And be sure to have clear possession, so AI doesn’t develop into the excuse when one thing breaks.
The businesses that repair this now would be the ones nonetheless standing when the vulnpocalypse shakes out. They’ll flip safety from a bottleneck into a bonus that lets them transfer quicker.
