Ex-Google CISO Phil Venables: 70% of vulnerability effort is deployment, not discovery
philvenables · x · 2026-11-02
Former Google security executive Phil Venables published "The Vulnpocalypse - Good News and Bad News", arguing via the Theory of Constraints that vulnerability discovery and fix development each account for only 10% of total effort, while 70% is stuck in field deployment — so accelerating AI scanning without fixing deployment just builds backlog.
Key points:
- AI tooling has flooded teams with new vulnerabilities; many orgs still sit on years of legacy software, config and structural flaws.
- Some defenders are keeping up with faster triage, prioritization and defense in depth; attacker resource constraints have left many targets unexploited — for now.
- Attackers are industrializing; so far monetization hasn't improved much outside scams, Web3 and parts of the ransomware kill chain.
- The same AI tools enable "deep cleaning" of codebases (h/t Heather Adkins), but clean code doesn't mean packaged updates reach targets quickly.
The accompanying infographic breaks remediation into six stages and notes vulnerability scarcity will eventually flip the bounty economic model.
More from Infra
- Podcast: AI verification hardware could enable a binding US-China AI treaty — wfithian · 2026-11-02
- Google Cloud unveils Agent Compute Engine: hardware-isolated microVMs for the agentic era — Arindam_1729 · 2026-11-02
- Google's Agent Compute Engine: checkpointed microVMs stop paying for agent idle time — Arindam_1729 · 2026-11-02
- H100 contract prices up 38% in five months — compute now prices like credit — pdamodaran · 2026-11-02
- YC F26's Superserve launches agent cloud, already running 100K machines weekly — ycombinator · 2026-11-02
- John Ousterhout to present Homa transport protocol for low small-message latency in AI workloads — cfregly · 2026-11-02