What will it take to make VulnOps a reality?

Just over a year ago, before advanced AI models began discovering software vulnerabilities at a nearly unmanageable scale in the so-called vulnpocalypse, three industry experts pioneered the concept of “VulnOps.” VulnOps, as envisioned by Heather Adkins, Gadi Evron, and Bruce Schneier, is a significant phase in the evolution of AI-assisted cyber defense in which vulnerability research and remediation would become scalable, repeatable, automated, and integrated into enterprise operations. They contemplated that this new era of organizational vulnerability management would progress from AI-augmented vulnerability management to self-healing networks. Since then, the Cloud Security Alliance has developed an operating VulnOps model, SANS has published VulnOps implementation guidance and will be introducing VulnOps training, and practitioners are beginning to experiment with the constituent technologies surrounding the idea. The real question, however, is whether VulnOps development is happening fast enough to keep pace with the onslaught of vulnerability discoveries. As Evron, CEO and founder of AI security and data access governance platform Knostic, tells CSO, “I’m looking at the world right now, and I’m seeing that a lot of people are spending a ton of money finding vulnerabilities. But the challenge is: What do we do once we find them? And that’s where it gets really complex.” Not your father’s vulnerability management program The most obvious precursor to how VulnOps can create a mindset shift in vulnerability management is the widespread shift in software development created by DevOps. According to IBM, DevOps is “a software development methodology that accelerates the delivery of high-performance applications and services by combining and automating the work of software development (Dev) and IT operations (Ops) teams.” Experts stress that VulnOps, however, doesn’t mean doing existing vulnerability management faster by adding AI components. It is an entirely new way of approaching vulnerability management that relies on AI agents to automate and speed up how organizations deal with vulnerabilities. They say it is nothing short of an entire overhaul of existing vulnerability discovery, prioritization, and remediation practices. “The core philosophy is moving to more continuous automated processes and faster feedback loops, as we did with DevOps, where we’ve learned to produce more code faster,” Rich Mogull, chief analyst at the Cloud Security Alliance, tells CSO. “We’re now taking that into vulnerability management. If you think about what was different about DevOps, it was the philosophy about going from an iterative cycle to a continuous cycle with fast failure and feedback loops.” Ed Skoudis, president of the SANS Technology Institute, argues that AI must become central to how vulnerability management operates. “What we’re talking about here is an AI-centric workflow where the AI is doing most of the analysis, and humans are just overseeing the operation,” Skoudis tells CSO. Not everyone, however, is convinced that VulnOps represents such a fundamental departure from established practices. “It feels like a rebranding to me,” Chris Elgee, SANS principal instructor and senior security analyst at Counter Hack Challenges, tells CSO. “Organizations have always had to deal with vulnerability management,” says Elgee, who agrees that the accelerating pace of vulnerability discovery is putting new pressure on organizations, but questions whether VulnOps constitutes a fundamentally different discipline. Is human-in-the-loop dead? Experts disagree on one fundamental aspect of VulnOps as they currently understand the concept. The disagreement centers on how much human control can survive when vulnerability remediation has to operate at AI speed. “The biggest struggle people have with patching vulnerabilities in general is that it’s disruptive to the workflows,” Ali Khan, CISO of AI-powered device security company Iru, tells CSO. “Generally, when there’s a security vulnerability and you need to patch it, you have to upgrade your source code or the third-party supply packages,” Khan explains. “And generally, that leads to breaking changes, especially in legacy systems that have been long-lived and are in maintenance mode,” Khan says. “You don’t want to bring a company down or destroy their revenue stream by pushing a patch that essentially stops the business process.” That risk is why most security professionals aren’t eager to take humans out of the loop. CSA’s Mogull cautions, “We’re nowhere near fully automating [the remediation] part of the process. Eventually, we will need more, but we’re not there yet, even with today’s tools,” he says. Nor does he envision VulnOps operating without human oversight. “Remember, humans are the ones that are accountable,” Mogull says. He points out that under the CSA operating model he helped develop, AI can make decisions within predefined policies, but potentially disruptive changes still require human intervention. SANS Technology Institute’s Skoudis argues for what he calls a governance-in-the-loop process where “you have governance that decides that, ‘Hey, if a given action that I take could fall below this governance-in-the-loop level, just do it. Automate it. Don’t even think about it.’” “Each organization is going to have its own separate line for where governance in the loop will apply, but you could say, for example, regarding important patches for Windows workstations, deploy them if they’re critical, on a rolling basis. So, in other words, do 25% per hour or two, over the space of half a day.” Knostic’s Evron, however, believes that even these arrangements may prove unsustainable as AI accelerates vulnerability discovery and exploitation. “One of the main understandings of the last couple of months is that human in the loop is dead,” he says. “We simply can’t move fast enough for the vast majority of operations to have a human in the loop.” On top of that, Evron questions whether autonomous patching itself will remain an adequate solution. “We must understand that patching is just not going to be fast enough,” Evron says. “We must start considering how we build security programs in a world where patching is not viable.” Autonomous patching may only be transitional Evron thinks automated patching is a necessary interim step, but that even fully automated remediation may eventually prove inadequate as AI accelerates vulnerability discovery and exploitation. “Start your program for autonomous patching today, but understand that we need to prepare for a world without patching,” he warns. “If we have a human in the loop, it’s just a performer. The human would have all the responsibility with no authority and no ability to understand and comprehend what they’re doing.” Evron argues that the industry should stop thinking exclusively about finding flaws and fixing them after the fact and should opt instead for software and defensive systems that prevent vulnerabilities from being introduced, detect and neutralize exploitation in the first place, or make individual vulnerabilities less consequential. He sees three approaches to making these preventative systems a reality. The first is to embed them directly into AI coding agents, rather than relying primarily on vulnerability scanning after code has been written. “Control your coding agents and you control your code, so the code itself gets generated more secure,” Evron says. He also advocates scanning code for vulnerabilities upon generation, rather than waiting for it to enter traditional continuous integration pipelines. The second approach is to detect and neutralize attacks at runtime. Evron describes what he calls “patch in place during runtime.” At this year’s [un]prompted conference, Evron went on stage to show ways of conducting patch in place during runtime. “As an attack is going on, it is detected in the logs and patched,” Evron says. The third approach to creating a system that obviates the current patching cycle is to make patching less urgent through defense in depth, according to Evron. He suggests moving toward approaches in which critical vulnerabilities become a matter of defense in depth, “so you don’t necessarily need to patch immediately.” Steps CISOs should be taking now According to Evron, the most critical step CISOs should take in embracing VulnOps is to stop relying solely on established practices that may prevent them from recognizing how AI is fundamentally changing the threat environment. For example, basic security hygiene remains important but cannot be treated as a sufficient response to AI-driven vulnerability discovery, he says. “Stop being afraid to imagine, go bigger, and understand that, well, of course our basics always matter; they will not save us,” he adds. And yet other experts question how organizations can embrace the challenging new world of VulnOps without first nailing down their security basics. Counter Hack’s Elgee says, “A lot of organizations, maybe most organizations, don’t even have a full concept of what their entire asset inventory is.” Iru’s Khan says that CISOs should start to think about how security and engineering need to renegotiate their relationships, given that security teams cannot simply hand developers remediation tickets and expect faster results. “This wall has to come down, and there has to be comfort letting other teams contribute in a technical way to systems,” Khan says. SANS Technology Institute’s Skoudis advises CISOs to begin implementing VulnOps without attempting to transform the entire enterprise over to a new paradigm. He argues that organizations should start to establish governance boundaries within which AI agents can operate. “If it’s above the threshold, if it’s higher business risk, then you have to have a human review it,” Skoudis says. “But if it’s below the governance-in-the-loop threshold, push it.” Evron is confident that CISOs can expect their existing teams to handle the transition to VulnOps, particularly if they reduce their dependence on the vulnerability scanning tools that kick out so many vulnerability reports. “The existing teams can handle this, but not with the current technologies they use,” he says. “We must stop paying mindlessly to the big scanning services because the bottleneck has always been fixing and patching.” He adds, “Therefore, building a system where we trust autonomous patching is what we must do right now, in the immediate term, and longer term in our plans we must understand we will not be able to rely on patching.”