@thomholwerda@exquisite.social
2026-09-29 13:27 UTC
So the concept of the CVE is undergoing inflation because the slop companies have a vested interest in turning every minor bug into a dangerous security issue? To make it seem as if "AI" code scanning tools are better at finding security issues than they really are?
Am I off the mark here?
Replies (1)
-
@jeremywc@infosec.exchange 2026-09-29 13:39
@thomholwerda@exquisite.social The rate at which critical vulnerabilities are being surfaced is also vastly increasing. These are not just exclusively low risk bugs. It's an increase across all severity levels. It's a bit of a Pandora's box that's probably not going to be closed. I do think large, complex projects need to invest in LLM based code scanning in their SDLC pipelines. This is probably not that far of a leap from code scanning processes many of them already have in place.