Will the number of CVEs in 2031 be higher or lower than 2026?

[spraoi@tooting.ch]

@evan

I think it will peak in 2027 or 2028.

[monnier@oldbytes.space]

@evan It will be a secret because it will have been bought out by GAFAM which will sell streaming access via subscriptions to specific channels

[johnefrancis@cosocial.ca]

@evan it will be a time of great disruption, and change brings CVE's.

[luc@chaos.social]

@evan will you tag us in 2031 to see if we got it right?

[jamesmarshall@sfba.social]

@evan I think the number of vulnerabilities created by "AI" will be greater than the number of vulnerabilities found or fixed by "AI".

[plumbert@thecanadian.social]

@evan Much lower, perhaps
0.

The entire CVE system will be overwhelmed by the amount of slop generated crapware that it will collapse before 2031. In addition, AI companies will sue researchers for publishing what are perceived as "negative statements" about their software, and the resulting fear and loathing will eliminate the last remaining publication of vulnerabilities.

[evan@cosocial.ca]

Thanks to everyone who responded. Here are my thoughts.

[josh@hactivedirectory.com]

@evan Faulty question: assumes we will get to 2031.

[evan@cosocial.ca]

CVEs are public reports of security issues, more or less.

https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures

[evan@cosocial.ca]

The number per year has been overwhelming for a while; they have shot up ~2-3x over the last year or so.

https://www.cve.org/about/Metrics

[evan@cosocial.ca]

There are three reasons commonly cited:

- AI scanners are finding a lot of security issues
- AI code generators are making more mistakes
- New processes have made it easier to report issues

[evan@cosocial.ca]

So, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.

[evan@cosocial.ca]

Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.

As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.

[evan@cosocial.ca]

I think this process will negate the problem with AI generated code. AI and human written code are both scannable.

[evan@cosocial.ca]

So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?

[evan@cosocial.ca]

I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.

[evan@cosocial.ca]

As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.

[evan@cosocial.ca]

There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.

[evan@cosocial.ca]

Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.

[evan@cosocial.ca]

I added a calendar event to remind myself to check.