---
title: "AI Is Finding Vulnerabilities Faster Than Your Team Can Triage Them"
description: "Microsoft fixed more flaws in October 2026 than in any previous year, and open source vulnerabilities per codebase doubled. Here is what that does to triage."
url: https://whitespots.io/blog/ai-is-finding-vulnerabilities-faster-than-your-team-can-triage-them
slug: ai-is-finding-vulnerabilities-faster-than-your-team-can-triage-them
author: "Whitespots Team"
tags: ["triage", "containers", "cve", "vulnerability-management", "open-source"]
publish_date: 2026-11-05T00:00:00.000Z
last_modified: 2026-11-05T14:46:00.000Z
---

# AI Is Finding Vulnerabilities Faster Than Your Team Can Triage Them

On October 14, Microsoft released fixes for more than 1,400 vulnerabilities in a single Patch Tuesday. Trackers count it slightly differently, from 1,403 to 1,416. Zero Day Initiative summed up the scale this way: the October release alone is larger than any previous full year from Microsoft.

The growth is striking. Microsoft set a record with 570 fixes in July, broke it with 974 in September and passed 1,400 in October. Microsoft confirmed active exploitation of just one of the October flaws. Vendors credit AI-assisted research for the jump, and Satnam Narang of Tenable described the result this way: AI-assisted discovery is creating larger haystacks without finding more needles.

![Microsoft Patch Tuesday volume in 2026: 570 fixes in July, 974 in September, more than 1,400 in October](https://whitespots.io/api/image/554a1dc14c0db6727ec2ce49447bd645.png)

Windows patches land on laptops and servers that IT manages. But the same speed of discovery applies to the open source code your developers ship every day, and the security teams sorting through these lists obviously aren't growing at that pace, and they can't.

## The same surge is in your dependencies

According to NIST, CVE submissions grew 263% between 2020 and 2025, and the first quarter of 2026 ran nearly a third higher than the same period a year earlier. 2025 closed with 49,972 published CVEs, and FIRST expects 2026 to set a new record.

Black Duck's 2026 Open Source Security and Risk Analysis report shows what this looks like inside real applications. Across 947 audited codebases, the average number of open source vulnerabilities per codebase reached 581, up 107% in a year. Black Duck links the growth to AI coding assistants: files per codebase rose 74% and open source components 30%. Only 7% of components were on their latest version, and 92% of codebases contained components four or more years out of date.

## Why container images multiply the count

A container image carries an operating system layer, system packages and every application dependency. When a new CVE lands in a package inside a popular base image, every image built on that base inherits it. If two hundred services share one base image, a single CVE turns into two hundred findings, and more if several scanners report it separately.

Images also age. A service built once and deployed for months keeps the layers it was built with, while new CVEs keep arriving for the packages inside them. The finding count grows even when nobody touches the code.

![One CVE in a base image becomes a finding in every image built on top of it](https://whitespots.io/api/image/169e4d45d8f3b0e2935f4674de9ed569.png)

## The arithmetic of manual triage

Each new CVE in a base image or library becomes findings in image and dependency scanners. Every finding needs someone to check whether it applies, decide how urgent it is and open a ticket. The cost is easy to calculate:

`findings per month × minutes per finding ÷ 60 × 12 × hourly cost = annual triage cost`

At two minutes per finding, three typical team sizes look like this:

| | 50 devs / 100 repos | 200 devs / 500 repos | 500 devs / 2,000 repos |
|---|---|---|---|
| Findings per month | 800 | 3,000 | 9,000 |
| Minutes per finding | 2 | 2 | 2 |
| Engineer cost | €30/h | €30/h | €30/h |
| Triage hours per month | 27 | 100 | 300 |
| Full-time equivalents | 0.19 | 0.70 | 2.09 |
| **Triage cost per year** | **€9,600** | **€36,000** | **€108,000** |

*Full-time equivalents assume 1,720 productive hours per engineer per year.*

Put your own numbers into the formula. Even at an optimistic two minutes per finding, a mid-sized team spends 1,200 engineer-hours a year sorting scanner output. Those hours could go into work that actually lowers risk: preparing and running secure coding training for developers, reviewing architecture before a release, or fixing the findings that matter. Meanwhile, the number of open source vulnerabilities per codebase doubled in a single year, and the next months are unlikely to bring less.

![A security engineer on his first day and three months later, buried in scanner alerts](https://whitespots.io/api/image/c864004ad4dcfccbbb287b15719704e2.png)

## What decides priority when everything looks critical

With hundreds of findings scored 8 or higher, CVSS alone sorts very little. Three questions do more work:

- Is the vulnerability being exploited right now?
- Is the affected package actually used, or does it sit in a layer your application never calls?
- Is the image running in production, and how critical is the service it runs?

If the score is the only input, the same CVE gets the same priority in an image that runs your payment service in production and in an image that sits untouched in a test registry. A risk-based process exists to close that gap.

![The same CVE with the same CVSS score gets Critical priority in a production payment image and Low in a test image](https://whitespots.io/api/image/fae91f63b9f0cbb94ce96c7b6b8ca2bd.png)

## How Whitespots handles it

Whitespots connects with one webhook on your VCS group, with no pipeline edits and no CI templates to copy. Every repository is picked up for scanning from the day it is created, so coverage doesn't depend on someone preparing each project by hand. The platform scans the container images your DevOps team ships to production, along with code, dependencies, secrets and infrastructure as code, and runs the triage steps before a finding reaches an engineer:

- Cross-scanner deduplication turns the same issue reported by several scanners into one finding.
- Rule-based auto-validation filters out false positives.
- Custom CVSS rules, reachability rules and business context rescore severity for your environment, so a flaw in a production payment image ranks above the same flaw in a test image.
- Jira tickets are created automatically with two-way sync, so nobody spends five to ten minutes per finding copying data by hand.
- SLA timers by severity give every finding a deadline and an owning team, and the finding closes automatically once a rescan verifies the fix.
- The Weighted Risk Trend shows leadership one number tracked against a risk threshold they set themselves, instead of a raw vulnerability count.

| | Triage by CVSS, by hand | Risk-based process |
|---|---|---|
| New repositories | Added to scanning by hand, project by project | Scanned from day one through one VCS webhook |
| What goes first | Everything with CVSS 9+ | Exploitable flaws in production images of critical services |
| One CVE from several scanners | One finding per scanner | One finding |
| Who sorts the list | Engineers, by hand | Rules, before a person sees it |
| Tickets | Five to ten minutes each, typed manually | Created automatically |
| What leadership sees | Total vulnerability count | Risk trend against a threshold |

## The question for your next budget meeting

How many of this month's findings in your container images did your team actually need to act on, and how many engineer-hours did it take to find out?

---

**Sources:** [Security Affairs](https://securityaffairs.com/?p=200953), [Krebs on Security](https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/), [Help Net Security](https://www.helpnetsecurity.com/?p=366659), [Computer Weekly](https://www.computerweekly.com/news/366638949/CVE-volumes-may-plausibly-reach-100000-this-year), [SC Media](https://www.scworld.com/news/open-source-vulnerabilities-per-codebase-surge-by-107)