At this year’s RSA Conference, I moderated a panel on GenAI code security that surfaced an uncomfortable truth. As one panelist, Dave Aitel from OpenAI, put it bluntly: “We’re seeing a huge forest fire of all this technical debt coming due all at once.” He’s right. We’re in what could be called the vulnpocalypse, where decades of accumulated security debt are colliding head-on with AI-accelerated code generation.
Here’s the part nobody wants to admit. Developers have never fully understood all the code they ship. AI didn’t create that problem. What it did was compress years of technical debt discovery into months, forcing companies to finally deal with issues they’ve ignored for years.
Vibe Coding Meets Reality
We’ve jumped from AI code completion to full “vibe coding” in record time. That’s the workflow where you have an idea, write a prompt, and accept whatever the AI generates. During the RSAC panel, Dave admitted he’s shipped major features in Rust despite never writing a single line of Rust himself.
That sounds reckless until you realize the real question. Do organizations have the infrastructure to manage code when understanding is split between humans and machines?
A clear pattern is emerging. The organizations doing well with AI development aren’t the ones with the fanciest tools. They’re the ones who already had their act together. As panelist Daniel Miessler, who runs AI security company Unsupervised Learning, put it, if your engineering practices are “a soup sandwich,” AI won’t fix that. You’re just making the mess faster.
The winners already mapped their components, documented their processes, and understood their systems before AI showed up. Now they’re adding AI to a solid foundation and getting real productivity gains. Everyone else is adding speed to chaos.
The Control We Never Had
One point from the panel has stuck with me. Maybe organizations never had complete control to begin with. Think about it. Even before AI, how much of an entire codebase could any single developer explain? They knew their piece and maybe their team’s work, but the whole system? No chance.
AI gives us better tools to understand what’s been built. You can ask your codebase questions now and get instant documentation. The tradeoff is that everything moves faster.
Kelly Shortridge from Fastly made the crucial point during the panel that software doesn’t exist in a vacuum but is a sociotechnical system. Engineers need to talk to each other, build shared understanding, and work together when things break. The real danger is that AI erodes the collaborative knowledge that keeps systems running during a crisis.
Why Traditional Remediation Can’t Keep Up
For years, the standard approach to vulnerability remediation worked well enough. Sort vulnerabilities by CVSS score, fix the critical ones first, work your way down. That strategy assumed a relatively stable rate of new vulnerabilities.
That assumption is dead. Our 2026 State of Software Security research found that 82% of organizations now carry security debt, up from 74% just a year ago.
When organizations create vulnerabilities faster than they can fix them, prioritization becomes pointless. You’re bailing water from a boat while the hole gets bigger. At some point, arguing about bucket size is absurd.
The panel revealed something important. Organizations handling remediation well made their investments before the crisis hit. They built security into their development workflows years ago instead of bolting it on at the end. When security testing runs in the IDE and gives developers immediate feedback, vulnerabilities get fixed in minutes. That prevents debt from piling up in the first place.
These companies also stopped treating Common Vulnerability Scoring System (CVSS) measurements as gospel. A high severity bug in unreachable code matters less than a medium severity issue in your authentication flow. The sophisticated teams map vulnerabilities to actual risk based on whether attackers can reach them and exploit them.
What Technology Leaders Should Do Now
We were asked during the panel whether enterprises need AI defense to counter AI-driven development. The answer isn’t that organizations need robots fighting robots. They need solid engineering practices. They’ve always needed them. The difference is, they just need them right now.
Here’s the critical question for technology leaders. How long would it take your team to fix every critical vulnerability across your applications? If you think months or years, you’re already underwater. The vulnpocalypse isn’t approaching. You’re in it.
Start with honest measurement. Count your known vulnerabilities, but also track how fast you’re introducing new ones. If that rate is climbing (and for most companies, it is) your entire remediation approach needs to change.
Then build what the RSAC panelists called “layers of defense.” Automate what you can. Add integration testing to catch problems AI-generated code might create. And make sure you have clear ownership, so AI doesn’t become the excuse when something breaks.
The companies that fix this now will be the ones still standing when the vulnpocalypse shakes out. They’ll turn security from a bottleneck into an advantage that lets them move faster.
