From AI Findings to Action: How Security Teams Should Triage AI-Discovered Vulnerabilities

Security teams didn’t need a headline to tell them that vulnerability volumes continue to be problematic. The CVE database now contains over 354,000 records. Annual disclosure rates have climbed steadily for more than a decade. And remediation backlogs have long been recognized not as an aberration, but as a fixture of the job. 

What AI-powered vulnerability research tools are doing now is accelerating a problem that was already well underway. Models capable of auditing code autonomously, chaining lower-severity issues into working exploits, and producing proof-of-concept output at scale are compressing into days, or even hours, what used to take research teams months. These models produce more findings, faster disclosures, and broader coverage of the attack surface than we’ve ever seen. 

For security teams, the question now is how to build the processes and tooling to triage and prioritize at this new breakneck pace without letting the volume win. 

Will AI Increase the Volume of Vulnerabilities Security Teams Need to Fix? 

The volume of vulnerabilities reported will no doubt be higher, especially as older software is subjected to AI analysis. But volume has always been a problem. How much worse will it get, and where does the pressure land? 

AI models are demonstrating the ability to identify software weaknesses across large codebases faster than any human team could. Microsoft has noted that frontier AI can autonomously discover weaknesses and chain multiple lower-severity issues into working exploits. Cisco has acknowledged that vulnerabilities previously sitting latent in codebases for years are now being found on a much shorter timeline. Vendors and security researchers using AI-assisted tooling are filing more CVEs, faster, and the teams receiving those disclosures don’t get more hours in the day to process them. 

The backlog crisis didn’t begin with large language models. According to the CVE Program, there are currently over 354,000 CVE records accessible globally. The majority of these were created over decades that predated the advent of generative AI. What changes with capable AI research tools is velocity and reach. The surface being audited gets larger; the time between discovery and disclosure shrinks; and findings arrive at higher volumes, from more sources, than before. 

This all puts a premium on what happens after discovery: the triage and prioritization work that determines what gets fixed, and when. The goal remains fixing the right things in the right order, fast enough to matter. AI-accelerated discovery just raises the stakes on having that process actually work. The cost of making the wrong prioritization decisions or moving too slowly just went way up. 

How Can Security Teams Keep Up with Vulnerabilities Discovered by AI? 

To keep pace with the volume of new vulnerabilities, it is necessary to increase the output of remediated vulnerabilities while ensuring the most important ones are being worked on at any given time. This simply cannot be done at human speed; security teams need to incorporate automation at every step possible to drive their results. A few principles apply: 

Anchor Triage to Business Risk, not Severity Alone 

Severity scores from detection tools are a starting point, not a final answer. A critical-severity vulnerability in a system with no network exposure, no sensitive data, and a pending decommission date is a very different problem than a medium-severity flaw in an internet-facing application handling customer authentication. AI discovery tools surface findings rapidly but may or may not understand your environment. That context must come from your team, and the system of record must update dynamically as your environment changes. Risk-based prioritization platforms must automatically factor in asset criticality, exposure, exploitability, and business impact together. 

Normalize and Aggregate Before you Act 

Findings now arrive from multiple sources: security research disclosures, vendor advisories, bug bounty programs, internal scanning, and AI-generated research outputs, each with different formats, scoring systems, and severity conventions. Before meaningful prioritization decisions can happen, that data needs to be normalized into a common framework. What I’d call good, or even adequate, triage now requires aggregation and normalization across sources. Those aren’t optional enhancements or ‘nice to have’ any longer. 

Connect Findings to Remediation Owners and Actions Automatically 

Speed at discovery without speed at routing just creates a bigger pile of unassigned tickets. Effective vulnerability management at AI-accelerated volume requires tight integration between vulnerability data and remediation workflows: ticketing systems, DevOps pipelines, and infrastructure change management. If you look at the teams keeping pace, you’ll find automatic routing sending findings enriched by accurate context to the right owners for the job. Teams with analysts manually triaging spreadsheets are the most likely to be falling behind. 

Treat Human Review as Essential Quality Control 

With AI surfacing hundreds or thousands of findings in a single research run, human analysts can’t be the first filter. Automated scoring, deduplication, and contextual enrichment should reduce the queue before human eyes touch it. People should be making judgment calls on the hardest cases and validating automated decisions. Some of the most effective workflows begin with automation followed by agentic analysis before human review. Your analysts shouldn’t be wasting time reading raw output line-by-line. 

The teams that manage AI-accelerated vulnerability volumes are the ones with disciplined prioritization processes already in place. The window to build those processes is narrowing. 

What Are the Risks of Using AI for Vulnerability Prioritization? 

This question, in the right context, is an important one to consider. AI can introduce real risks into the prioritization function if done hastily, without a defined plan, or if your team ends up over-relying on it. Each risk bears careful examination and monitoring as your program’s AI use matures. 

• Rising Costs. AI solutions and models are still early in their lifecycle, and nowhere is this more apparent than in their pricing models. Many AI tools were priced initially to encourage adoption and help push capabilities forward. As they’ve entered the mainstream, AI providers are adopting pricing that covers the running cost of the models and drives profit. These costs are being passed down to the customer.
• Audit blind spots. AI models and the solutions built on them are considered “black box” solutions as far as auditors are concerned. Due to the inability to explain exactly how complex AI tools reach specific decisions or outcomes, organizations face mounting regulatory and compliance challenges.
• Over-reliance on AI. When teams defer entirely to AI-driven prioritization without maintaining human expertise in the reasoning behind decisions, they lose the ability to catch the cases where AI gets it wrong. Highly capable models can still make systematic errors that a knowledgeable analyst would catch. Human oversight shouldn’t be viewed as a checkbox in your AI strategy. It’s more appropriately considered a fundamental control that keeps your systems honest and outcomes reliable. 

Building a Triage Model Fit for the AI Era 

The through-line across all three questions is the same: the fundamentals of good vulnerability management don’t change because AI is generating more findings. They become more important. 

Risk-based prioritization. Normalized data across sources. Automated routing to remediation owners. Human oversight at decision points. These are the practices that distinguish teams that manage vulnerability backlogs from teams that are buried by them. AI-driven discovery accelerates the timeline on which teams need those practices in place. It doesn’t invent new requirements. 

What it does demand is tooling that can operate at the new scale. Manually managed spreadsheets and disconnected scanner outputs were already struggling. At AI-generated discovery volumes, they won’t hold. 

Security teams that are serious about staying ahead need a vulnerability management platform capable of aggregating findings from any source, normalizing them into a consistent risk framework, and routing validated priorities to the teams responsible for acting on them. Far from being something to plan for in the future, it’s a current requirement that demands a solution today.