Artificial intelligence (AI) is accelerating software vulnerability discovery, but federal cybersecurity officials say the growing volume of findings makes it increasingly important to distinguish serious threats from flaws that pose little practical risk.
Speaking on Oct. 28 at Red Hat’s Government Summit in Washington, D.C., Jay Gazlay, acting associate director for vulnerability management at the Cybersecurity and Infrastructure Security Agency (CISA), said AI tools are uncovering weaknesses at a scale that could overwhelm security teams without a targeted approach to remediation.
“Every other piece of software I have seen that’s not formally verified is found to have a tremendous number of vulnerabilities. It is amazing. Our team took a frontier model and pointed it at a very common model we all use and turned a relatively minor denial of service part into a remote code execution,” Gazlay said.
But uncovering more vulnerabilities doesn’t necessarily mean more require immediate action. Gazlay said security teams need evidence of a vulnerability’s potential impact before deciding how to respond.
“For me to make a decision on a policy basis or to tell somebody to do something, I need to see proof,” he said.
That means looking beyond a flaw’s existence to determine whether it can be exploited and which systems it could affect.
Gazlay said teams can deprioritize many vulnerabilities based on their characteristics and the systems involved. For example, a flaw in an internal-facing system may warrant a different response than one that enables remote code execution on an internet-exposed system.
He urged agencies to focus their limited remediation resources on internet-facing systems and vulnerabilities with demonstrated exploitation, rather than treating every reported weakness as equally urgent.
“Because the reality is, in vulnerability management, most vulnerabilities don’t need to get patched. Most vulnerabilities can be safely ignored,” Gazlay said.
CISA is looking to AI to help manage the growing volume of vulnerability reports, he said.
Gazlay pointed to Gold Eagle, a platform designed to help identify and remediate cybersecurity vulnerabilities across the nation’s critical infrastructure sectors using advanced AI models.
He said the platform is preparing to handle hundreds of thousands of cases, with an AI-powered front end to help sort incoming submissions and identify findings that warrant closer attention.
Beyond sorting vulnerabilities, Gazlay emphasized that effective prioritization depends on knowing what technology an organization operates and where its systems are exposed.
He urged agencies to maintain comprehensive asset inventories and require software vendors to provide software bills of materials, which identify the components used in their products.
Those records can help security teams determine whether vulnerable software is present in their environments and whether affected systems are exposed to potential attackers.
Without that visibility, agencies risk spending limited resources investigating vulnerabilities that may have little bearing on their actual security posture.
Gazlay also cautioned that AI-driven advances in vulnerability discovery have not displaced the familiar methods attackers use to compromise systems.
“The reality is, threat actors are still just walking in by the tools they know how to use, and they are doing that in critical infrastructure every day,” he said.
He recommended strengthening identity controls, segmenting networks, and improving visibility into data leaving critical systems to help organizations defend against those threats.
For operators of mission-critical systems, Gazlay said understanding outbound data flows should be a basic security capability.
“For those of you who run mission-critical systems, knowing what data comes out of your system is something everybody should be able to do at this point.” he observed.