AI Industrialized the Vuln Lifecycle and Broke the System of Record

Episode notes

VulnCheck's Patrick Garrity on the NVD collapse, the first real AI disclosure wave, and why remediation, not finding bugs, is the bottleneck. Description Vulnerability management spent years as the chore everyone dreaded, and now it is one of the hottest topics in security because attackers made exploitation the number one way in. Patrick Garrity of VulnCheck rejoins the show to separate what is real from what is marketing. We get into the honest state of the NIST National Vulnerability Database after CISA pulled its funding, the new AI executive order that wants a clearinghouse for AI-discovered vulnerabilities, the first measurable wave of AI-assisted disclosures, and Patrick's audit of Anthropic's Glasswing ledger. We also dig into why cheap AI discovery makes the remediation bottleneck worse, how AI is raising the security poverty line, and whether the 90-day disclosure model still holds. Key takeaways Vulnerability management is hot again because attackers made it the top way in. As Patrick puts it, attention flows to wherever the attacker goes, and right now that is exploitation. The NIST NVD breakdown was worse than a backlog.

• Rain Versus Flood, Making Sense of the 2026 CVE Surge76 / 100
• You Don't Need A Frontier Model to Find Zero Days
• AI Is Winning the Cyber Arms Race
• Securing the Agentic SDLC
• The Agentic GRC Revolution