AI and Cybersecurity: 26,000 vulnerabilities detected, less than 1% patched — the asymmetry redefining risk

Hook

An AI model detected over 26,000 software vulnerabilities in five months. Less than 1% were actually fixed. This ratio, from the Project Glasswing program's assessment, summarizes the new equation of global cybersecurity: the capacity to discover flaws has been multiplied by artificial intelligence, but the capacity for remediation remains human, slow, and structurally insufficient. The imbalance is no longer a theoretical hypothesis. It is measured, documented, and it is worsening.

Key Points

1. An industrial bottleneck between detection and correction. Out of over 26,000 vulnerabilities identified by a specialized AI model, barely 0.8% were actually repaired, and only 10.5% were transmitted to the affected publishers. This ratio shifts the cybersecurity problem: automated detection is only valuable if the remediation chain — publishers, development teams, maintenance managers — absorbs the flow. However, this chain operates at a human pace, with prioritization, non-regression testing, and deployment constraints that do not compress at the same rate as automated analysis. The rate of true positives and the actual severity of the announced flaws are also subject to methodological disputes, which adds a layer of uncertainty: the figure of 26,000 itself is debated.

2. Technological sovereignty becomes a public procurement policy. A framework agreement between a major AI model provider and the US federal administration ended a symbolic pilot program — access to models for one dollar per year — in favor of a 50% flat discount on standard rates via the General Services Administration's OneGov government marketplace. This shift illustrates a strong trend: states are no longer content to subsidize AI research; they are becoming structuring clients, with scale effects that consolidate the position of dominant players. The pilot program allowed 3.5 million federal employees to use these tools, generating claimed savings of $1.4 billion. The transition to a discounted rate transforms AI into an ordinary budgetary expense, subject to public procurement logic and competition.

3. AI's energy infrastructure becomes a market in itself. A startup specializing in off-grid power systems for data centers raised $120 million in Series A funding, led by a long-time investor in one of the leading AI labs. This operation values the company at approximately one billion dollars. It signals that the energy constraint of AI infrastructures is now generating dedicated investment vehicles, with a valuation that reflects less technological maturity than the anticipation of structural demand. The funds will be used to recruit engineers and develop manufacturing operations — in other words, to industrialize a response to a problem whose scale remains to be demonstrated.

4. The shortage of human skills worsens despite automation. The cybersecurity market in G7 countries is experiencing a 9.5% growth in job offers, with a doubling of demand for AI skills. Agentic AI, far from reducing human needs, reconfigures them: it shifts value towards interpretation, prioritization, and supervision, rare skills that do not develop at the pace of deployments. Ethical reasoning, critical thinking, and judgment become bottlenecks as constraining as technical skills.

5. AI extends to increasingly specialized scientific and industrial fields. A foundation model dedicated to lunar science, trained on petabytes of mission data, is now available open source on a model sharing platform. Simultaneously, digital solutions for the mining industry transform operational data into production and safety management tools. These cases illustrate a verticalization dynamic: generic AI gives way to sectoral models, which are more difficult to audit and secure.

Context

The convergence between artificial intelligence and cybersecurity is not a new phenomenon, but it has changed scale with the arrival of foundation models capable of analyzing code at scale. Until the mid-2020s, vulnerability detection relied on static tools and specialized teams, with quarterly publication cycles. The emergence of models trained on massive code corpora broke this time barrier: analysis that took weeks now takes hours.

The precedent of coordinated disclosure campaigns, which had already saturated publishers in the 2010s, is repeating today on a larger scale. The difference lies in the nature of the bottleneck: yesterday, detection was limiting; today, it is correction. This structural asymmetry defines the new landscape, where value shifts from discovery to industrialized remediation.

An aggravating factor is added: methodological dispute. The figures put forward by automated detection programs are themselves fragile. The rate of true positives, the actual severity of the flaws, the relevance of the reports — all of this is debated by independent analysts. In other words, the imbalance between detection and correction could be even more pronounced than official figures suggest, or conversely less severe if a significant portion of detections prove unexploitable. This uncertainty is not a detail: it determines resource prioritization.

Key Players

Leading AI labs — Anthropic, OpenAI, and to a lesser extent Google DeepMind and Mistral — occupy an ambivalent position. They provide the tools that detect flaws, while themselves being targets and potential vectors of vulnerabilities. Their strategy is to monetize access to their models for governments and businesses, while managing the reputational risk associated with security incidents. The end of a one-dollar-per-year pilot program for US federal agencies, replaced by a 50% discount via a government marketplace, marks a transition: AI becomes an ordinary budgetary expense, subject to public procurement logic.

This ambivalence is reinforced by internal tensions within the sector. Dissenting voices, including former researchers from these labs, denounce an irresponsible race towards ever more powerful systems, without proportionate precautions. These criticisms, whether judged founded or excessive, weigh on the reputation of the players and fuel distrust among regulators.

The United States structures its approach through federal procurement and standardization of public markets. India is advancing on another front: the deployment of facial authentication backed by a national biometric identifier, integrated directly into banking, insurance, and brokerage applications via a dedicated development kit. This approach makes identity infrastructure a lever for security and control, with profound implications for privacy and fraud.

Software publishers and internal security teams are the most constrained actors. They receive a flow of vulnerabilities that they cannot absorb, which forces them to prioritize according to criticality and exposure criteria. This often opaque prioritization creates a systemic risk: known but uncorrected flaws remain exploitable for months.

Investors, finally, play a growing role. The $120 million fundraising of an off-grid power startup for data centers, led by an Anthropic investor, shows that venture capital is now funding the underlying infrastructure for AI, not just the models. This verticalization of investment creates new interdependencies between energy, computation, and security.

Data and Figures

Available data shows a 9.5% growth in cybersecurity job offers in G7 countries, with a doubling of demand for AI skills. This figure, compared to the pace of professional training, suggests that the shortage will not be resolved in the short term.

On the industrial front, the analysis of weak signals reveals an overall severity of 3 to 4 out of 5 in areas such as manufacturing, logistics, predictive maintenance, turbines, compressors, pumps, maritime, and oil and gas. Time horizons vary: direct impacts on costs in 1-5 years, strategic reorientations in 3-10 years, regulatory compliance in 2-7 years. These data suggest that the AI-cybersecurity convergence affects not only the technology sector but all critical infrastructures.

The ratio of less than 1% of vulnerabilities corrected out of 26,000 detected is the most revealing figure. It indicates that detection capacity has progressed much faster than remediation capacity. If this trend continues, the theoretical attack surface will mechanically increase, even if the actual criticality depends on the nature of the flaws and their exploitability.

One figure deserves emphasis: only 10.5% of detected vulnerabilities were transmitted to publishers. In other words, nearly nine out of ten flaws did not even reach the inbox of those who could fix them. The bottleneck is therefore not only in correction: it starts with transmission.

Analysis of Issues

In the short term, the pressure is on publishers and security teams. Automated detection produces a flood of reports that saturates correction processes. Companies that do not invest in automated remediation — automated testing, continuous deployment, risk-based prioritization — will find themselves with a backlog of known, uncorrected vulnerabilities. This backlog becomes a target for attackers, who can exploit documented but unpatched flaws.

The cybersecurity market benefits, but asymmetrically. Providers of automated remediation solutions, patch management, and AI-based prioritization capture new demand. Managed security services, which absorb the operational load, are experiencing growth driven by the skills shortage. In contrast, companies that internalize security without automating see their costs increase without a proportional reduction in risk.

In the medium term, the question of responsibility becomes central. If an AI model detects a flaw but the publisher does not fix it, who is responsible in case of exploitation? Current regulatory frameworks, designed for slower disclosure cycles, do not clearly answer this question. The European Union, with its texts on cybersecurity and AI, is beginning to structure obligations, but the articulation between automated detection and the obligation to correct remains unclear.

India illustrates another trajectory: the integration of facial authentication into financial applications shifts security to the user entry point. This approach reduces dependence on passwords but creates new risks: biometric spoofing, algorithmic bias, dependence on a centralized identifier. The Indian model, if it becomes widespread, could become a reference for countries seeking to secure access to financial services without multiplying authentication factors.

This interpretation is, however, contested. Some analysts believe that remediation automation will progress faster than expected, reducing the gap between detection and correction. Others consider that risk-based prioritization, even if imperfect, is sufficient to manage actual exposure, with the majority of detected vulnerabilities being of low criticality. These alternative interpretations highlight the uncertainty surrounding projections based on a single ratio.

One point remains under-discussed: signal quality. If a significant portion of the 26,000 detections are false positives or minor flaws, the 0.8% correction ratio is less alarming than it appears. But if, conversely, the detections are mostly relevant, then underinvestment in remediation becomes a strategic error. The answer to this question conditions everything else.

Prospective Hypotheses

Scenario 1: Remediation industrializes (estimated probability: 40%). Publishers and platforms invest heavily in automated correction, with pipelines integrating detection, prioritization, and deployment. The correction ratio increases from less than 1% to 10-15% in two years. Conditions for realization: decrease in the cost of automated testing, widespread adoption of continuous deployment pipelines, moderate but credible regulatory pressure. Indicators to monitor: announcements of automated remediation tools by major publishers, growth in security automation spending, evolution of the correction ratio published by disclosure programs.

Scenario 2: The gap widens and becomes a systemic risk (estimated probability: 45%). Detection continues to progress faster than correction. The backlog of known, uncorrected vulnerabilities increases, and major incidents exploit documented but unpatched flaws. Conditions for realization: absence of economic incentive for correction, fragmentation of responsibilities, opaque prioritization. Regulators then impose binding correction deadlines, creating new pressure on publishers. Indicators to monitor: number of incidents related to known flaws, evolution of regulatory correction obligations, complaints from publishers about the disclosure burden.

Scenario 3: Regional fragmentation slows global response (estimated probability: 15%). Divergent approaches — US public procurement, Indian biometric authentication, European regulation — create fragmented markets. Publishers must adapt their processes to each jurisdiction, slowing global correction. Conditions for realization: proliferation of incompatible local requirements, absence of mutual equivalence between standards. Indicators to monitor: proliferation of local requirements, divergence of disclosure standards, compliance costs by region.

Why This Is Important

Cybersecurity is no longer a technical problem reserved for experts. It determines the continuity of financial services, the security of energy infrastructures, the protection of personal data, and the sovereignty of states. The imbalance between detection and correction of vulnerabilities directly affects any organization that depends on software — that is, all of them.

Concretely, three immediate consequences. First, any organization using third-party software inherits a security liability it does not control: flaws detected in the products it uses will likely not be corrected in time. Second, prioritization becomes a strategic skill: knowing which flaws to ignore is as important as knowing which ones to fix. Third, legal responsibility shifts: organizations that know a flaw exists — because an automated tool detected it — and do not fix it expose themselves to a new risk: that of documented negligence.

The question is not if your organization will face a detected but uncorrected flaw, but when. The answer will depend on the ability to automate remediation at the same pace as detection. Does your organization have the means to keep up with this pace, or is it accumulating a security liability that will eventually manifest itself?