AI Didn't Break Vulnerability Management: It Exposed Its Biggest Weakness
Infosecurity Magazine, Friday, October 23rd, 2026
A Hogan Lovells partner argues AI-driven discovery reveals that severity scores were never the same thing as business risk.
Scott Loughlin of Hogan Lovells argues that programs built on severity ratings and fixed deadlines were always flawed because severity is not risk.
AI-enabled tools can cheaply test chains of low and medium flaws that a per-vulnerability CVSS score cannot see, and he contrasts a critical CVE on a segmented lab instrument with a moderate authentication bypass on an internet-facing patient portal.
CISA's BOD 26-04 now prioritizes on exposure, known exploitation, automatability and attacker control, and allows deferring low-risk fixes.
The bottleneck is prioritization, not discovery, so vulnerability management is becoming a governance discipline tied to business risk.