Will the number of CVEs in 2031 be higher or lower than 2026?
-
So, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
-
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
I think this process will negate the problem with AI generated code. AI and human written code are both scannable.
-
I think this process will negate the problem with AI generated code. AI and human written code are both scannable.
So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?
-
So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?
I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.
-
I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.
As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.
-
As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.
There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.
-
There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.
Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.
-
Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.
I added a calendar event to remind myself to check.
-
@evan will you tag us in 2031 to see if we got it right?
@luc I added a calendar reminder!
-
Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.
As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.
AI security scans are also vulnerable to prompt injection. Portswigger have some cool labs based on a vulnerable AI scanner.
