AI discovery turns vulnerability hunting into a purchasing decision. The budget runs out at the part that protects you.
“Software will always have vulnerabilities you haven’t found” has held as a working truth for as long as anyone in security has had a job. Security programs took the assumption as a foundation: triage, rank, accept the residual risk, repeat next quarter.
The assumption has an expiry date on it now. Any vulnerability a human can find, an AI can find, which means discovery runs on token spend rather than on ingenuity, and spend is a number you control.
David Seidman, Head of Platform Security at Plaid, put the conclusion plainly on a recent episode of Backline Unfiltered: in practice, we’ll find nearly all of them.
Follow the economics out and the number you control turns into a number your adversary has to match.
A number you set, and your adversary pays
Picture a company that keeps buying compute against its own code until each additional vulnerability costs ten million dollars to surface. The figure came up on the episode as an illustration rather than a real budget, and the shape of it matters more than the digits.
Anyone who wants a zero-day in that code now faces the same ten million dollar bill, because the ‘affordable vulnerabilities’ are gone.
The company hasn’t reached zero vulnerabilities. It has reached economic zero, where the cost of discovery exceeds what nearly any attacker will pay to get in.
Two caveats travel with the idea, and both narrow it usefully.
A research advance in prompting could drop somebody’s cost per vulnerability below yours, and your price collapses with theirs. Economic zero describes a position you hold rather than a state you achieve, and holding it costs money every quarter.
The second caveat is severity. Nobody’s spending ten million dollars to find a UI discrepancy, so the economics only binds on the vulnerabilities with attackers attached. Everything else stays as expensive to fix and as easy to defer as it has always been.
The timeline estimate runs under ten years, close enough to matter for budgets people are writing now.
The half of the problem with no price on it
Patching isn’t rocket science, and the framing that says otherwise has done real damage to how security teams ask for resources. Upgrading a pinned Python runtime and the fifteen technologies hanging off it takes hours, not invention. You don’t need a research advance to close a known CVE.
One problem in the chain genuinely resists money, and it sits after the fix.
“Every time you patch a service, you typically have no idea if it’s going to break,” Seidman said. Tests help. AI writes more of them. Yet esoteric interactions between services still take down public-facing systems after changes that looked trivial in review.
The stronger version of the claim goes further. Humans haven’t solved safe rollouts either, and the industry has no existence proof that safe rollouts are possible at the scale of modern distributed services.
Google can release a change slowly across billions of users and hold the blast radius to a few thousand people. The luxury disappears in an emergency patch, and companies smaller than Google never had it.
So the ledger runs asymmetrically. Discovery has a price you can pay. Validation has a queue you have to work.
The bill arriving before the price does
Nobody sits at economic zero today. What’s arriving instead is volume.
A frontier model finds a flaw in an open-source dependency, the maintainer takes a couple of months to ship a patch, and only then does the work land on you. The lag reads as calm from inside a mature security team, and the calm is a scheduling artifact rather than a verdict on the threat.
The early warning sits in the bug bounty world. Response times keep lengthening, and some organizations have closed their programs outright because they can’t process the inbound.
Those submissions used to be noise. Now validation comes back clean, which means real vulnerabilities and real patches queued behind them.
The ugly version has a probability attached to it, and the estimate on the episode landed well short of a 95 percent chance and well clear of zero: the tech industry pulls half its engineers off product work to clear security debt.
For a company whose dependency graph already exceeds what its entire engineering team could remediate in six months, the fire drill is a scheduling question rather than a forecast.
“If you can fix it, fix it”
We put our own position to the test on air, because it’s the one we keep having internally.
If a fix is safe, cheap, and carries evidence it holds under test, why spend effort proving the vulnerability is reachable first? Unreachable today becomes reachable after next quarter’s refactor, and the proof expires the moment somebody moves the code.
Seidman takes the other side, and the defense of reachability tooling is worth sitting with.
A denial-of-service flaw in a component nobody outside the network can touch earns a different response. If one of your own laptops attacks an internal server, you take the laptop off the network and get on with your day.
AppSec at Microsoft ran on the same logic a decade before AI entered the picture: rate patches on the code paths that exist in practice rather than the code paths that could theoretically exist. An exploitable condition reachable three ways on paper often has two routes nobody can actually use.
Severity draws the line. A zero-click remote code execution vulnerability gets patched everywhere it appears, exposed or not, because the downside of guessing wrong arrives the same week.
Both positions reduce to a single variable. Reachability filtering rations scarce validation capacity, so the case for triage weakens exactly as confidence in the change gets cheaper to produce.
Spend where the line forms
Economic zero treats discovery as procurement, and procurement is the easier governance problem. You approve a budget, watch the cost per vulnerability climb, and decide when the curve has flattened enough.
The other half of the ledger never shows up as a purchase order. Your throughput comes from how much change your organization can absorb per week without breaking a customer-facing service, which is a function of test coverage, rollout mechanics, and how much verification runs before a human ever opens the pull request.
Two numbers belong on the same page as your discovery budget: the share of your fixes that arrive with evidence they broke nothing, and the wait between “patch available” and “patch merged.”
A team that can answer both can price its attacker out of the market. A team that can only answer the first has bought itself a longer list.
Our customer’s story shows what the second number looks like when validation travels with the fix, from five weeks down to under a day.
Economic zero hands you a lever on the adversary’s budget. The lever on your own team calendar is the one worth pulling first.
