Vulnerability Discovery and Exposure Management at Machine Speed

All courses / AI Red Team / Module 3 / Chapter 11

Learning objectives

After the lesson the participant can:

• Explain why the constraint has moved from finding vulnerabilities to verifying, prioritising and fixing them.
• Apply the three rules of verification: sandboxed reproduction, proof of fix and reviewer capacity as a budget.
• Compare what EPSS, the KEV catalogue, the EUVD, exposure and business context each answer and where each is limited.
• Draft a delegated patch decision with classes, conditions, time limits, exclusions and evidence.

Key concepts

Every patch is an exploit specification

The statement from AI Platform and Security, Chapter 18: a published fix tells an adversary where to look. The chapter cites exploitation rising from 10.5 vulnerabilities a month in 2025 to 18 in 2026, driven by rapid weaponisation of newly disclosed vulnerabilities.

Sandboxed reproduction

No AI finding reaches a person until a machine has tried to reproduce it. A harness builds the component in an isolated sandbox without network egress or production credentials and runs the proposed test case; a finding that does not reproduce returns to tuning.

Proof of fix

A proposed fix is accepted only when the reproduction case no longer triggers the flaw, the component's existing tests still pass, and the case joins the regression suite. The reviewer then judges a complete package and not a claim.

Delegated patch decision

A recorded judgement, taken once for a defined class of change, that for a known-exploited vulnerability on an exposed asset the risk of waiting exceeds the risk of a reversible change. It removes the change board from the path; irreversible changes still go through the board.

Patch velocity

The time from a vulnerability entering a priority class to a verified fix or compensating control. It is reported to the management body with a target, a trend and the exceptions behind any miss.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. Roughly one finding in ten was wrong even in the best-resourced programmes. What does that imply for an organisation that switches on AI code review without a verification step?
2. Why do both example organisations keep their exposure prioritisers at Level 0 Advisory, and what would have to be true before you raised one?
3. Hansa Mutual records that no agent applies fixes in production on its own authority. Under which conditions, if any, would you revisit that position?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the chapter identify as the binding constraint once AI finds vulnerabilities at scale?

   1. The number of vulnerability identifiers that can be assigned each month
   2. The cost of model access for discovery in ordinary engineering budgets
   3. The availability of sanitisers for memory-safe programming languages
   4. The human capacity to verify, triage and patch what is found
   Show the answer

   D. The human capacity to verify, triage and patch what is found
   Discovery has outpaced repair: the Glasswing update named human capacity to triage and patch as the constraint, and the chapter calls verification capacity the binding constraint.

2. What happens, under the chapter's severity thresholds, to a high finding from AI review that has not been reproduced?

   1. It blocks the merge until a security architect has dismissed it
   2. It creates a tracked item without blocking the merge
   3. It is discarded and removed from the reviewer's quality metrics
   4. It is disclosed to the maintainer on the agreed timeline
   Show the answer

   B. It creates a tracked item without blocking the merge
   Confirmed critical or high findings block the merge; unreproduced high findings create a tracked item without blocking, so that an unconfirmed claim cannot stop delivery.

3. Which change does the practical guide exclude from a delegated patch decision?

   1. A supplier-published fix for a vulnerability listed in the KEV catalogue
   2. A fix on an internet-facing asset with a rollback tested last month
   3. An irreversible firmware change
   4. A fix applied in the next maintenance window within 72 hours
   Show the answer

   C. An irreversible firmware change
   Reversibility is what makes delegation safe. Irreversible firmware changes, safety-critical systems and changes to the security tooling itself are excluded and still go through the board.