The VulnOps Operating Model
Open Until: 08/19/2026
Vulnerability management still runs on periodic cycles: scheduled scans, monthly patch windows, CVSS-sorted queues. AI is breaking that model on both ends. Discovery has accelerated sharply, with autonomous tools surfacing hundreds of validated vulnerabilities in a single pass and vendors shipping AI-accelerated patch volumes that dwarf prior release cycles. Remediation throughput has not kept pace, and the gap shows up directly in the data: vulnerability exploitation is now the leading initial access vector, and organizations fully remediated only a quarter of known exploited vulnerabilities in 2025. This paper proposes VulnOps, an operating model that replaces batch vulnerability management with a continuous pipeline, in the same way DevOps replaced scheduled software releases. Three inbound streams, pre-release code, deployed systems, and external disclosures, converge on one flow of triage, validation, sequencing, deployment, and verification, gated by evidence rather than schedule. The paper defines absorption rate (findings resolved versus findings created) as the program's core health metric, sets out governance and human-in-the-loop requirements for agent-driven discovery, and lays out the prerequisites and pilot structure for standing up the function within an organization.
Key Takeaways
- Vulnerability management's batch model (scheduled scans, monthly patch windows, CVSS queues) is breaking under AI-accelerated discovery and vendor patch volume.
- Exploitation is now the leading initial access vector; only 26% of known exploited vulnerabilities were fully remediated in 2025.
- VulnOps replaces the cycle with one continuous pipeline across three streams (pre-release, deployed systems, external disclosures), gated by evidence rather than schedule.
- Absorption rate (findings resolved ÷ findings created, rolling 30 days) is the core health metric; above 1.0 means the program is keeping pace.
- Governance-in-the-loop (GITL) is default, with human-in-the-loop reserved for exploit confirmation, out-of-class production deployment, and external disclosure.
- Seven prerequisites (named owner, asset inventory, deployment automation, etc.) must be in place before piloting; the recommended charter timeline is 12 months.
Contribute to Peer Review
Premier AI Safety Ambassadors
Premier AI Safety Ambassadors play a leading role in promoting AI safety within their organization, advocating for responsible AI practices and promoting pragmatic solutions to manage AI risks. Learn more about how your organization could participate and take a seat at the forefront of AI safety best practices.
