Will the number of CVEs in 2031 be higher or lower than 2026?
-
Will the number of CVEs in 2031 be higher or lower than 2026?
@evan I think the number of vulnerabilities created by "AI" will be greater than the number of vulnerabilities found or fixed by "AI".
-
Will the number of CVEs in 2031 be higher or lower than 2026?
@evan Much lower, perhaps
0.The entire CVE system will be overwhelmed by the amount of slop generated crapware that it will collapse before 2031. In addition, AI companies will sue researchers for publishing what are perceived as "negative statements" about their software, and the resulting fear and loathing will eliminate the last remaining publication of vulnerabilities.
-
Will the number of CVEs in 2031 be higher or lower than 2026?
Thanks to everyone who responded. Here are my thoughts.
-
Will the number of CVEs in 2031 be higher or lower than 2026?
@evan Faulty question: assumes we will get to 2031.
-
Thanks to everyone who responded. Here are my thoughts.
CVEs are public reports of security issues, more or less.
https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
-
CVEs are public reports of security issues, more or less.
https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures
The number per year has been overwhelming for a while; they have shot up ~2-3x over the last year or so.
-
The number per year has been overwhelming for a while; they have shot up ~2-3x over the last year or so.
There are three reasons commonly cited:
- AI scanners are finding a lot of security issues
- AI code generators are making more mistakes
- New processes have made it easier to report issues -
There are three reasons commonly cited:
- AI scanners are finding a lot of security issues
- AI code generators are making more mistakes
- New processes have made it easier to report issuesSo, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.
-
So, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
-
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
I think this process will negate the problem with AI generated code. AI and human written code are both scannable.
-
I think this process will negate the problem with AI generated code. AI and human written code are both scannable.
So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?
-
So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?
I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.
-
I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.
As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.
-
As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.
There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.
-
There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.
Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.
-
Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.
I added a calendar event to remind myself to check.
-
@evan will you tag us in 2031 to see if we got it right?
@luc I added a calendar reminder!
-
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
AI security scans are also vulnerable to prompt injection. Portswigger have some cool labs based on a vulnerable AI scanner.
