What Happened
A mid-sized financial services company deployed an AI-powered vulnerability scanning tool in July to support their SOC 2 Type II recertification. The tool integrated with their CI/CD pipeline, analyzing every commit, dependency update, and infrastructure change.
By the end of Q3, the AI scanner flagged 847 vulnerabilities across their application stack. The security team, using existing resources, managed to remediate 203 of them, a 24% remediation rate.
In October, auditors reviewing their SOC 2 controls noted the growing backlog. More critically, 34 of the unaddressed findings were rated critical or high severity. The company passed their audit with observations, but the gap between discovery and repair became a primary action item for leadership.
This isn't a breach story. It's a capacity story, and it's happening at organizations adopting AI-assisted security tools.
Timeline
- July 15: AI scanning tool deployed, integrated with GitHub and Jenkins.
- July 22: First scan complete; 312 vulnerabilities identified.
- August 1: Security team begins triage; 89 findings marked for immediate remediation.
- August 30: 127 new vulnerabilities flagged in dependency updates and new feature branches.
- September 15: 408 additional findings from expanded scope (added microservices repos).
- September 30: End of quarter count: 847 total findings, 203 remediated, 644 in backlog.
- October 12: SOC 2 audit fieldwork begins; auditors request remediation metrics.
- October 20: Audit observation issued regarding vulnerability management capacity.
Which Controls Failed or Were Missing
The AI tool worked as designed. The control failures were human and process-based:
No risk-based prioritization framework. The team treated all AI-flagged vulnerabilities equally, working through them in chronological order rather than by exploitability or business impact. When you're discovering issues faster than you can fix them, first-in-first-out doesn't work.
No capacity planning for increased discovery volume. The security team sized their sprint capacity based on manual penetration testing cadence (quarterly) and SAST findings (weekly). AI-assisted continuous scanning changed the input volume significantly, but the team size didn't change.
Insufficient integration between discovery and remediation workflows. The AI tool created Jira tickets. Developers lacked context on which tickets represented actual risk versus theoretical vulnerabilities in unused code paths. Without that context, remediation velocity stayed constant while the backlog grew.
No SLA differentiation by severity. ISO 27001 Control 8.8 requires managing technical vulnerabilities, but it doesn't prescribe response times. This team had a blanket "30-day remediation" policy that didn't account for critical findings requiring immediate action versus low-severity issues that could wait.
What the Relevant Standards Require
SOC 2 CC7.1 (Common Criteria for System Operations) requires identifying and responding to security incidents and vulnerabilities. Discovery without remediation doesn't satisfy the control. Your auditor will ask: What's your process for prioritizing and tracking remediation? How do you ensure critical vulnerabilities are addressed within a reasonable timeframe?
PCI DSS v4.0.1 Requirement 6.3.1 states you must identify security vulnerabilities using reputable sources and assign a risk ranking to newly discovered vulnerabilities. Risk ranking is mandatory. If your AI tool is flagging hundreds of issues without a systematic way to rank them by actual risk to cardholder data, you're not meeting the requirement.
NIST CSF v2.0 maps this to ID.RA-01 (vulnerabilities are identified and documented) and RS.MA-01 (incidents are contained, eradicated, and recovered from). Identification without containment is incomplete execution. The framework expects you to close the loop.
The standards assume you have a vulnerability management program that can handle the volume you're discovering. When AI accelerates discovery, your program needs to scale in response.
Lessons and Action Items for Your Team
Build a risk-scoring model that your developers trust. CVSS scores alone don't tell you whether a vulnerability matters in your specific environment. Consider: Is the vulnerable component reachable from the internet? Is it processing sensitive data? Is there a known exploit in the wild? Your AI tool can help with this analysis, but you need to define the criteria.
Set severity-based SLAs and staff to meet them. Critical vulnerabilities in production: 24-48 hours. High severity: 7 days. Medium: 30 days. Low: next major release or 90 days. Then calculate: At current discovery rates, how many person-hours per week do you need to hit those SLAs? If you're short, you need more people or you need to reduce scope.
Separate signal from noise with environmental context. Not every vulnerability the AI finds is exploitable in your architecture. If you're running a container that includes a vulnerable library, but your application never calls that library, deprioritize it. Automate this where possible. Tools like Snyk and Dependabot can tell you if a vulnerable dependency is actually imported in your code.
Create a fast path for critical findings. When the AI flags something that meets your criteria for critical (exploitable, internet-facing, touches PII or payment data), it shouldn't go into a sprint backlog. It should trigger an incident response process with a dedicated channel and immediate assignment.
Report discovery-to-remediation metrics to leadership. Your CISO needs to see: vulnerabilities discovered this month, vulnerabilities remediated this month, backlog size, and average time-to-remediation by severity. If the gap is widening, that's a budget conversation, not a security team performance issue.
AI-assisted vulnerability discovery is a capability upgrade. But it's not a complete solution until your remediation capacity scales to match. The organizations that figure this out will have a genuine security advantage. The ones that don't will have impressive vulnerability databases and unchanged risk profiles.
