At this yr’s RSA Convention, I moderated a panel on GenAI code safety that surfaced an uncomfortable fact. As one panelist, Dave Aitel from OpenAI, put it bluntly: “We’re seeing an enormous forest hearth of all this technical debt coming due suddenly.” He’s proper. We’re in what could possibly be known as the vulnpocalypse, the place a long time of gathered safety debt are colliding head-on with AI-accelerated code technology.
Right here’s the half no person desires to confess. Builders have by no means absolutely understood all of the code they ship. AI didn’t create that downside. What it did was compress years of technical debt discovery into months, forcing corporations to lastly take care of points they’ve ignored for years.
Vibe Coding Meets Actuality
We’ve jumped from AI code completion to full “vibe coding” in file time. That’s the workflow the place you’ve an thought, write a immediate, and settle for regardless of the AI generates. Throughout the RSAC panel, Dave admitted he’s shipped main options in Rust regardless of by no means writing a single line of Rust himself.
That sounds reckless till you notice the true query. Do organizations have the infrastructure to handle code when understanding is cut up between people and machines?
A transparent sample is rising. The organizations doing effectively with AI improvement aren’t those with the fanciest instruments. They’re those who already had their act collectively. As panelist Daniel Miessler, who runs AI safety firm Unsupervised Studying, put it, in case your engineering practices are “a soup sandwich,” AI gained’t repair that. You’re simply making the mess quicker.
The winners already mapped their parts, documented their processes, and understood their methods earlier than AI confirmed up. Now they’re including AI to a strong basis and getting actual productiveness beneficial properties. Everybody else is including velocity to chaos.
The Management We By no means Had
One level from the panel has caught with me. Perhaps organizations by no means had full management to start with. Give it some thought. Even earlier than AI, how a lot of a complete codebase might any single developer clarify? They knew their piece and possibly their workforce’s work, however the entire system? No probability.
AI offers us higher instruments to grasp what’s been constructed. You’ll be able to ask your codebase questions now and get on the spot documentation. The tradeoff is that the whole lot strikes quicker.
Kelly Shortridge from Fastly made the essential level throughout the panel that software program doesn’t exist in a vacuum however is a sociotechnical system. Engineers want to speak to one another, construct shared understanding, and work collectively when issues break. The true hazard is that AI erodes the collaborative information that retains methods operating throughout a disaster.
Why Conventional Remediation Can’t Maintain Up
For years, the usual method to vulnerability remediation labored effectively sufficient. Type vulnerabilities by CVSS rating, repair the essential ones first, work your manner down. That technique assumed a comparatively steady fee of recent vulnerabilities.
That assumption is useless. Our 2026 State of Software program Safety analysis discovered that 82% of organizations now carry safety debt, up from 74% only a yr in the past.
When organizations create vulnerabilities quicker than they will repair them, prioritization turns into pointless. You’re bailing water from a ship whereas the outlet will get larger. Sooner or later, arguing about bucket measurement is absurd.
The panel revealed one thing necessary. Organizations dealing with remediation effectively made their investments earlier than the disaster hit. They constructed safety into their improvement workflows years in the past as a substitute of bolting it on on the finish. When safety testing runs within the IDE and provides builders rapid suggestions, vulnerabilities get fastened in minutes. That stops debt from piling up within the first place.
These corporations additionally stopped treating Frequent Vulnerability Scoring System (CVSS) measurements as gospel. A excessive severity bug in unreachable code issues lower than a medium severity situation in your authentication move. The delicate groups map vulnerabilities to precise danger based mostly on whether or not attackers can attain them and exploit them.
What Expertise Leaders Ought to Do Now
We had been requested throughout the panel whether or not enterprises want AI protection to counter AI-driven improvement. The reply isn’t that organizations want robots combating robots. They want strong engineering practices. They’ve all the time wanted them. The distinction is, they simply want them proper now.
Right here’s the essential query for know-how leaders. How lengthy would it not take your workforce to repair each essential vulnerability throughout your purposes? When you suppose months or years, you’re already underwater. The vulnpocalypse isn’t approaching. You’re in it.
Begin with sincere measurement. Depend your recognized vulnerabilities, but in addition monitor how briskly you’re introducing new ones. If that fee is climbing (and for many corporations, it’s) your total remediation method wants to alter.
Then construct what the RSAC panelists known as “layers of protection.” Automate what you may. Add integration testing to catch issues AI-generated code would possibly create. And be sure to have clear possession, so AI doesn’t turn out to be the excuse when one thing breaks.
The businesses that repair this now would be the ones nonetheless standing when the vulnpocalypse shakes out. They’ll flip safety from a bottleneck into a bonus that lets them transfer quicker.
