For as long as there's been software, there's been an unfair fight. The attacker needs to find one crack. The defender has to cover every wall, every window, every door, forever. That asymmetry is the oldest problem in security, and until recently, it moved at human speed on both sides.
That's over.
The math never favored us. Now it's moving faster than either of us can
Bug bounty programs aren't seeing more submissions because more humans decided to go hunting this year. They're seeing more submissions because AI systems are reading code the way we always wished a human could, except they don't get tired, don't get bored halfway through a legacy codebase, and don't need a paycheck to keep going. Zero-days that used to surface once a researcher happened to stumble onto the right function, at the right time, in the right mood, are now surfacing because something is looking at everything, continuously.
The old defender's math was: cover it all, and hope the one gap you missed isn't the one they find. AI doesn't change that math. It just runs it exponentially faster, on both sides of the table at once.
AI doesn't pick a side. That's exactly the problem
Here's the part that should keep security leaders up at night: AI isn't a weapon we get to keep. It makes the good better and the bad worse, in the same breath, for whoever picks it up first. A defensive team using AI to scan its own stack finds bugs before an attacker does. An attacker using the same class of tooling finds the bugs the defensive team's older processes were never fast enough to catch. Same technology. Opposite outcomes. Whoever adapts their process around it first wins that round.
This isn't a new front in an old war. It's the same asymmetry we've always had; one crack versus every wall; except now the side hunting for the crack has a machine that never sleeps, and the side building the wall is often still running on quarterly patch cycles and a backlog nobody's gotten to yet.
The flood isn't a fluke. It's the new baseline
Every security leader watching bug bounty numbers climb this year has had the same instinct: wait for it to level off. It won't. This is what "exponential" actually looks like from the inside; not a spike you ride out, but a new floor. The organizations treating this quarter's numbers as an anomaly are the ones who'll be caught flat-footed when next quarter's numbers are worse.
So what do you actually do with that?
- Stop measuring your security posture in patch cycles. If vulnerabilities are being found at machine speed, remediation stuck at human speed is your real exposure; not the bugs themselves.
- Assume the discovery rate on your own stack is higher than you think. Homegrown and lightly-managed open source components are the least likely to have anyone watching them at AI speed. That's exactly where the gap widens fastest.
- Put continuous monitoring ahead of periodic audits. A clean scan last quarter tells you nothing about this week.
- Get comfortable with the idea that "good enough" security debt compounds now, instead of sitting quietly for years the way it used to.
We didn't sign up for an arms race. We're in one anyway
Nobody chose this pace. It arrived. And the organizations that survive the next few years won't be the ones with the cleverest defenses on paper; they'll be the ones who accepted, early, that the old rhythm of finding and fixing is already gone.
The bad guys only ever needed one crack. Now they've got a machine helping them look for it around the clock. The only sane response is to stop defending at human speed too.
See how Ory defends at machine speed
