This article is based on an episode of CYBR.SEC.CAST featuring FireMon founder and CEO Jody Brazil, with hosts Michael Farnum and Sam Van Ryder. FireMon sponsored the episode. Full episode and related article:
, and CYBR.SEC.Media
Bill Brenner
Artificial intelligence is threatening to turn vulnerability management into a race defenders cannot win by patching alone. As AI tools become increasingly capable of discovering previously unknown software flaws and generating exploit code, organizations face a difficult question: What happens when attackers can find vulnerabilities faster than defenders can fix them?
For Jody Brazil, founder and CEO of FireMon, the answer starts with a fundamental shift in how organizations approach network security.
Rather than concentrating exclusively on finding and patching vulnerabilities, security teams must limit attackers' ability to reach vulnerable systems in the first place.
"Assume that every connected system is exploitable," Brazil said during a recent episode of CYBR.SEC.CAST, hosted by CYBR.SEC.Community CEO Michael Farnum and Sam Van Ryder.
It's a significant departure from the familiar "assume breach" philosophy. Brazil's argument is that the growing capabilities of AI require organizations to treat connectivity itself as a security exposure, regardless of whether a vulnerability has been identified.
AI changes the vulnerability equation
Brazil pointed to the emergence of powerful AI models capable of discovering vulnerabilities that have remained undetected for years, including flaws buried in widely used open-source software.
Such vulnerabilities can potentially affect millions of products, creating opportunities for attackers long before defenders know there's a problem.
Historically, discovering these weaknesses required substantial technical expertise. Developing reliable exploits demanded additional time and resources. AI threatens to reduce both barriers.
Brazil described a scenario in which relatively inexperienced attackers could use advanced AI tools to identify previously unknown vulnerabilities and produce exploit code in minutes rather than months.
The implications extend beyond faster attacks. They challenge the assumption that defenders can consistently identify vulnerabilities before adversaries exploit them.
During the discussion, Farnum suggested that AI could finally give defenders tools powerful enough to match those used by attackers.
Brazil agreed that AI creates an opportunity to improve defensive capabilities, but questioned whether competing directly with attackers in vulnerability discovery is the right strategy.
"The race to see who can find and patch a vulnerability is you always have a leg up when you are the attacker," he said.
Attackers need to find one exploitable weakness. Defenders must protect a sprawling collection of applications, systems and network connections.
AI may make vulnerability discovery more efficient for both sides, but that doesn't eliminate the underlying imbalance.
Stop chasing vulnerabilities. Start restricting access.
Brazil isn't suggesting that organizations abandon vulnerability management.
Security teams should continue identifying and patching vulnerabilities, including using AI to accelerate that work. Software vendors have an equally important responsibility to identify and remediate weaknesses in their products.
But patching must operate alongside another defensive priority: controlling which systems can communicate with one another.
"The most powerful thing we can do from a defensive standpoint is limit connections," Brazil said.
The distinction matters because a vulnerability's existence doesn't automatically mean an attacker can exploit it. The attacker must also have a viable path to the vulnerable system.
Network segmentation, restrictive firewall policies and carefully governed access controls can reduce those paths.
That doesn't make vulnerabilities disappear, nor does it eliminate every route to exploitation. But it can reduce the number of systems exposed to unauthorized connections and limit opportunities for attackers to move through an environment.
Brazil argued that organizations already possess much of the infrastructure necessary to enforce these restrictions.
Large enterprises have deployed hundreds or thousands of firewalls, creating numerous points where access can be controlled. The challenge is ensuring that those controls enforce the intended security policies.
Network security returns to the spotlight
For much of the past decade, cybersecurity innovation has emphasized cloud security, identity, endpoint protection and vulnerability management.
Network security remained essential, but Brazil believes the industry began treating it as a largely solved problem.
He pointed to application-aware firewalls, which emerged around 2010, as one of the last major advancements in traditional network security.
AI-assisted vulnerability discovery is forcing organizations to reconsider that complacency.
Brazil described the moment as a renewed recognition of network security's importance, particularly the ability to prevent connections from unauthorized or unknown actors.
The conversation also highlighted the relationship between this approach and continuous threat exposure management, or CTEM.
Modern exposure management increasingly considers whether vulnerabilities are reachable and exploitable, rather than simply counting flaws or prioritizing them by severity.
Brazil's argument takes that reasoning further.
Instead of only asking whether an attacker can reach a known vulnerability, organizations should examine why access to the underlying system is permitted at all.
That means scrutinizing unnecessary connectivity even when no vulnerability has been identified.
Can AI help defenders enforce those restrictions?
The irony is that the same technology accelerating the threat may also help organizations address one of their biggest defensive obstacles: complexity.
Brazil described enterprise environments containing thousands of firewalls and potentially millions of security rules, collectively governing billions of possible access paths.
Maintaining consistent, restrictive policies across those environments is beyond what security engineers can reasonably evaluate manually at scale.
This is where Brazil sees a more promising defensive role for AI.
Rather than relying solely on AI to discover vulnerabilities before attackers do, organizations can use it to analyze network policies, identify unnecessary access and help engineers make better decisions about connectivity.
The objective isn't to replace security professionals. It's to help them manage an increasingly complex collection of controls and enforce access restrictions more consistently.
That approach also aligns with zero-trust principles, which require access to be explicitly authorized rather than broadly assumed.
Brazil expects network security to continue evolving toward more granular controls, potentially defining access requirements for individual systems and even processes.
The difficulty is making those restrictions practical across constantly changing enterprise environments.
The defensive advantage isn't necessarily speed
Farnum's original proposition was that AI might finally allow defenders to match attackers' capabilities.
Brazil's response suggests that the more important opportunity lies in changing the contest itself.
Attackers can use AI to discover weaknesses faster. Defenders can use AI to improve vulnerability management, but they can also strengthen controls that make those weaknesses harder to exploit.
The practical implications for security leaders are straightforward: Continue patching aggressively, but also examine which systems are unnecessarily reachable, whether firewall policies reflect current business requirements and where segmentation could reduce exposure.
AI-assisted analysis may help make that work manageable, but it doesn't eliminate the need for sound architecture, policy governance or human oversight.
The objective is not to win every race to discover a vulnerability. It's to reduce the likelihood that discovering one gives an attacker a usable path into the organization.
As Brazil put it, the defensive approach should be to deny access to a system whether or not a vulnerability exists.
