AI just rewrote the offensive economics of finding and weaponizing vulnerabilities.

Most peers I’m talking to, and most vendor write-ups I’m reading, already get that patching alone isn’t enough. Yet patching still tends to land near the top of most response lists, and from what I’ve seen in the past 30 years, it’s the part of the plan least likely to deliver.

I don’t think patching should anchor the answer. Of course, we all want secure software, written well, and patched fast when things break. That’s the goal. It’s also not the reality, and I don’t see that changing.