AI accelerates code development faster than security teams can keep up

91% of respondents say their security budget is increasing this year, demonstrating a growing recognition of the importance of cybersecurity within organizations, according to Seemplicity.

Vendor environments introduce complexity and fragmentation

Seemplicity surveyed 300 US cybersecurity professionals to gauge perceptions on key topics, including vulnerability and exposure management, automation, AI, and regulatory compliance.

Organizations reported utilizing an average of 38 different security product vendors, indicating high levels of complexity and fragmentation within their attack surfaces.

This fragmentation contributes to 51% of respondents experiencing a high to very high level of noise from their tools, inundating them with a large volume of alerts, notifications, and findings, many of which are not definitive signals.

Consequently, 85% of respondents find it challenging to manage this noise. The top challenge cited is slow or delayed risk reduction, emphasizing the magnitude of the issue, as the overwhelming noise impedes efficient vulnerability identification and prioritization, thus slowing down the response to risks.

The growing role of automation in vulnerability management

95% reported leveraging at least one method to try and reduce noise, indicating acknowledgment of the problem and the urgent need to address it. 97% of respondents indicated some level of automation, suggesting a growing recognition of the benefits of automation in vulnerability and exposure management.

Automation is predominantly applied to the foundational steps in vulnerability and exposure management, including:

• Vulnerability scanning: 65% of respondents use automation to enhance the accuracy and efficiency of identifying vulnerabilities, making the process faster and more reliable.
• Vulnerability prioritization: 53% of respondents leverage automation to rank vulnerabilities based on their potential impact and urgency, ensuring that the most critical issues are addressed first.
• Remediation processes: 41% of respondents use automation to both identify the appropriate remediation team and implement remediation actions, streamlining the overall remediation process.

However, the fact that 44% of respondents still rely on manual methods in some capacity indicates that there may be barriers to full automation.

Regardless, the message from respondents is clear: automation has improved vulnerability and exposure management efficiency, with 89% of leaders citing its benefits. The top benefit noted is a faster response to emerging threats (65%).

According to the research, 85% of companies are planning to increase AI investment in the next 5 years. Respondents believe AI will have the most significant impact on the initial stages of vulnerability and exposure management:

• Vulnerability assessment: 38% of respondents believe AI will significantly enhance the accuracy and efficiency of identifying vulnerabilities.
• Vulnerability prioritization: 30% of respondents see AI as a key tool for effectively ranking vulnerabilities based on their potential impact and urgency.

AI seen as weapon against cyber threats

The predominant perception (64%) that AI will serve as a weapon against bad actors reflects optimism about its potential to bolster cybersecurity capabilities.

However, there is significant concern (68%) regarding the impact that the integration of AI in software development will have on vulnerability and exposure management. AI will rapidly speed up code development at a pace that security teams cannot keep up with, making effective vulnerability and exposure management a challenge.

More than half of the surveyed organizations perceive the new SEC incident reporting requirements as an opportunity to enhance their vulnerability management practices.

Specifically, leaders feel the new requirements will improve logging and reporting (53%) and improve security hygiene (52%). Surprisingly, less than a quarter of respondents felt that the regulation would create more bureaucracy (24%), pressure (23%) and distract their security teams (18%).

90% of respondents are likely to adopt Continuous Threat Exposure Management (CTEM) programs, reflecting a shift towards continuous monitoring and proactive risk management. Unlike traditional periodic assessments, CTEM enables organizations to stay ahead of threats by continuously monitoring their IT infrastructure for vulnerabilities.