CISO perspectives on managing vulnerability risks in the age of AI

Microsoft leverages frontier AI models to scan its code bases for vulnerabilities, integrating AI-powered processes into vulnerability handling and disclosure workflows to scale remediation efforts. While cloud software vulnerabilities are mostly mitigated by Microsoft without customer intervention, on-premises software users should anticipate a substantial rise in Patch Tuesday vulnerability disclosures, with September 2026 seeing nearly 1,000 vulnerabilities released. The non-deterministic nature of AI models means results vary between runs, but harness layers like MDASH improve scanning accuracy and integration. CISOs are advised to allocate more resources to patching, prioritize critical systems for faster patch deployment, and adopt AI-powered scanning harnesses. Defense-in-depth remains crucial as not all vulnerabilities will be patched in time. Microsoft also collaborates with industry peers to proactively address open-source vulnerabilities and emphasizes Secure by Design and Secure by Default to reduce customer burden in implementing security controls.

The use of frontier AI models has led to a significant increase in the volume of identified vulnerabilities, particularly for on-premises Microsoft software, increasing the patching workload for organizations. Cloud software vulnerabilities are largely mitigated by Microsoft without customer intervention, reducing direct impact on customers. However, the accelerated discovery and disclosure pace shortens the window between patch release and potential exploitation, increasing risk for unpatched critical systems. Organizations face operational challenges in balancing rapid patch deployment with system availability. The increased volume of vulnerabilities and patches may strain security teams and resources, potentially leading to delayed remediation and increased exposure. The collaboration on open-source vulnerability management helps reduce supply chain risks.

Microsoft manages mitigation of cloud software vulnerabilities without customer action. For on-premises Microsoft software, customers should prepare for a higher volume of patches and allocate increased resources to patching, prioritization, and timely deployment. CISOs should consider deploying patches to critical systems within 24 hours rather than waiting for traditional maintenance windows. Organizations are encouraged to use AI-powered scanning harnesses, such as MDASH, to identify and remediate vulnerabilities proactively. Emphasizing defense-in-depth controls and monitoring critical security controls is advised to limit attacker impact when patches cannot be applied immediately. Adoption of Microsoft Baseline Security Mode (BSM) and Secure by Design/Secure by Default principles can further improve security posture. Customers should consult Microsoft's Security Exposure Management resources for additional guidance.