Summary
AI is changing the economics of vulnerability discovery. What once required specialized research teams, significant time and bespoke tooling is becoming faster, more repeatable and increasingly available through frontier models, agentic workflows and AI-assisted security research.
Recent announcements make that shift concrete. Anthropic's release of Claude Fable 5 and Claude Mythos 5, along with its Project Glasswing update, shows how advanced cyber-reasoning capabilities are moving from research demonstrations into operational defensive use cases.
CrowdStrike's Project QuiltWorks, with Kroll among the initial partners, was built for the next step: helping organizations assess, prioritize and remediate AI-discovered vulnerabilities in production code.
In our conversations with clients since the Project Glasswing and Project QuiltWorks announcements, the question has moved from “What does this mean?” to “How do we operationalize the response?”
What Recent Developments Change for Leaders
- Frontier cyber capability is becoming operational. Fable 5 and Mythos 5 reinforce that advanced reasoning, code analysis and tool-use capabilities are moving into real-world defensive workflows.
- Project Glasswing is generating increased patch activity. Anthropic's initial update reported thousands of vulnerabilities across partner estates and open-source software. Microsoft has released substantially higher volumes of patches compared with the same period last year.
- The threat landscape is already heavy with vulnerabilities. Verizon's 2026 DBIR reported that 31% of breaches began with software vulnerability. Kroll's State of Resilience report found that 36% of organizations acknowledge gaps in how threats are prioritized, with 51% citing differing risk tolerance as the leading cause.
- Regulators are converging on evidence and accountability. SEC disclosure rules, NIST AI risk guidance, CISA/NSA guidance on agentic AI, UK financial-regulator statements on frontier AI and DORA-style resilience expectations all point toward defensible governance, documentation, third-party oversight and proof of operational resilience.
- AI-enabled systems are expanding the exposure surface. Public AI tools, embedded AI features, copilots, agents, model access, non-human identities, context stores and AI-assisted software development now need to be visible in exposure management programs.
From Discovery Speed to Remediation Velocity
AI-enabled discovery will increase the volume, speed and specificity of findings entering the enterprise risk system. For many organizations, the constraint will shift from identifying issues to deciding what action is required, who owns it, how quickly it should be funded, whether compensating controls are acceptable and how closure will be verified.
That shift elevates exposure management from a security workflow to an enterprise risk discipline. CISOs, CFOs, General Counsel, CROs and boards all need a shared operating model for determining which exposures require remediation, mitigation, risk acceptance, transfer, disclosure or continued monitoring.
A common operating model includes the following activities:
- Find: identify exposure across infrastructure, cloud, SaaS, applications, APIs, identities, third parties, open source and AI-enabled workflows.
- Contextualize: determine reachability, exploitability, attack paths, privilege impact, business criticality and compensating controls.
- Decide: choose remediation, mitigation, transfer, risk acceptance, disclosure or monitoring, with named owners and documented rationale.
- Act: fund and execute the fix or mitigation through infrastructure, application, cloud, identity, vendor and business owners.
- Prove: verify that the exposure was closed or meaningfully reduced through retesting, control validation and evidence capture.
- Report: translate residual exposure, accepted risk, ageing and investment needs into language executives and boards can use.
