At this yr’s RSA Convention, I moderated a panel on GenAI code safety that surfaced an uncomfortable fact. As one panelist, Dave Aitel from OpenAI, put it bluntly: “We’re seeing an enormous forest hearth of all this technical debt coming due unexpectedly.” He’s proper. We’re in what could possibly be known as the vulnpocalypse, the place a long time of collected safety debt are colliding head-on with AI-accelerated code era.
Right here’s the half no one desires to confess. Builders have by no means totally understood all of the code they ship. AI didn’t create that downside. What it did was compress years of technical debt discovery into months, forcing firms to lastly take care of points they’ve ignored for years.
Vibe Coding Meets Actuality
We’ve jumped from AI code completion to full “vibe coding” in document time. That’s the workflow the place you have got an thought, write a immediate, and settle for regardless of the AI generates. Throughout the RSAC panel, Dave admitted he’s shipped main options in Rust regardless of by no means writing a single line of Rust himself.
That sounds reckless till you understand the actual query. Do organizations have the infrastructure to handle code when understanding is cut up between people and machines?
A transparent sample is rising. The organizations doing nicely with AI improvement aren’t those with the fanciest instruments. They’re those who already had their act collectively. As panelist Daniel Miessler, who runs AI safety firm Unsupervised Studying, put it, in case your engineering practices are “a soup sandwich,” AI gained’t repair that. You’re simply making the mess sooner.
The winners already mapped their parts, documented their processes, and understood their techniques earlier than AI confirmed up. Now they’re including AI to a stable basis and getting actual productiveness beneficial properties. Everybody else is including pace to chaos.
The Management We By no means Had
One level from the panel has caught with me. Perhaps organizations by no means had full management to start with. Give it some thought. Even earlier than AI, how a lot of a whole codebase might any single developer clarify? They knew their piece and perhaps their group’s work, however the entire system? No probability.
AI provides us higher instruments to know what’s been constructed. You may ask your codebase questions now and get instantaneous documentation. The tradeoff is that all the things strikes sooner.
Kelly Shortridge from Fastly made the essential level in the course of the panel that software program doesn’t exist in a vacuum however is a sociotechnical system. Engineers want to speak to one another, construct shared understanding, and work collectively when issues break. The actual hazard is that AI erodes the collaborative information that retains techniques working throughout a disaster.
Why Conventional Remediation Can’t Maintain Up
For years, the usual strategy to vulnerability remediation labored nicely sufficient. Type vulnerabilities by CVSS rating, repair the essential ones first, work your means down. That technique assumed a comparatively secure fee of latest vulnerabilities.
That assumption is useless. Our 2026 State of Software program Safety analysis discovered that 82% of organizations now carry safety debt, up from 74% only a yr in the past.
When organizations create vulnerabilities sooner than they will repair them, prioritization turns into pointless. You’re bailing water from a ship whereas the outlet will get greater. In some unspecified time in the future, arguing about bucket measurement is absurd.
The panel revealed one thing necessary. Organizations dealing with remediation nicely made their investments earlier than the disaster hit. They constructed safety into their improvement workflows years in the past as a substitute of bolting it on on the finish. When safety testing runs within the IDE and provides builders rapid suggestions, vulnerabilities get fastened in minutes. That stops debt from piling up within the first place.
These firms additionally stopped treating Widespread Vulnerability Scoring System (CVSS) measurements as gospel. A excessive severity bug in unreachable code issues lower than a medium severity difficulty in your authentication circulate. The delicate groups map vulnerabilities to precise danger based mostly on whether or not attackers can attain them and exploit them.
What Know-how Leaders Ought to Do Now
We had been requested in the course of the panel whether or not enterprises want AI protection to counter AI-driven improvement. The reply isn’t that organizations want robots combating robots. They want stable engineering practices. They’ve at all times wanted them. The distinction is, they simply want them proper now.
Right here’s the essential query for expertise leaders. How lengthy would it not take your group to repair each essential vulnerability throughout your purposes? In the event you assume months or years, you’re already underwater. The vulnpocalypse isn’t approaching. You’re in it.
Begin with trustworthy measurement. Depend your recognized vulnerabilities, but additionally observe how briskly you’re introducing new ones. If that fee is climbing (and for many firms, it’s) your whole remediation strategy wants to vary.
Then construct what the RSAC panelists known as “layers of protection.” Automate what you’ll be able to. Add integration testing to catch issues AI-generated code may create. And ensure you have clear possession, so AI doesn’t turn out to be the excuse when one thing breaks.
The businesses that repair this now would be the ones nonetheless standing when the vulnpocalypse shakes out. They’ll flip safety from a bottleneck into a bonus that lets them transfer sooner.
