CSA: VulnOps in the Age of AI

What it is

CSA research note (published 2026-05-04) reframing vulnerability management as "VulnOps." The summary already carries the argument and the VulnOps definition; what it omits are the concrete numbers behind the claim and the three starting actions the note prescribes.

The numbers that anchor the argument

• NVD enriched 41,925 CVEs in 2025 — a 45% YoY increase and its largest output ever — and still ended the year with a backlog covering most of the inbound queue.
• Historical baseline was ~10,000 CVEs/year; the model is now absorbing 4–5x that.
• Google's Big Sleep agent reported 20+ previously unknown vulns in widely-used open-source since its fall-2024 launch (Aug 2025 disclosure).
• DARPA AIxCC: autonomous systems patched the majority of injected synthetic vulns in the Linux kernel, SQLite, and cURL, and surfaced 18 previously unknown real vulns in the process.
• Time-to-exploitation for high-impact vulns is now measured in days, with some weaponizations arriving within hours of disclosure (Mandiant M-Trends 2025).

What to do

The note gives three broadly-applicable starting points:

1. Instrument saturation. Measure inbound finding rate against remediation throughput, treat the ratio as a saturation metric, and report it to security leadership monthly. A consistently saturated program is a structural problem, not a staffing one — "more tickets" cannot fix it.
2. Diversify vulnerability intelligence. Do not depend on NVD alone (now enriching only KEV / EO 14028 / federal-use software). Pair it with at least one source covering the unenriched tail — named alternatives: VulnCheck, ENISA's EUVD — plus exploitability signals (CISA KEV, EPSS).
3. Treat remediation as code. Default response to a vulnerable container image, package version, or config should be a tested, repeatable change committed to a repo and shipped through the normal pipeline — not a service-desk ticket.

Supply-chain posture is framed against SLSA and NIST SP 800-218: a program should answer "where is this dependency in our stack?" within minutes.

Caveats

The note itself hedges the AI-discovery figures: "whether or not any single claim is reproduced at the stated scale," it argues the floor of AI-driven output already exceeds manual triage capacity.