Stop Counting Vulnerabilities. Start Proving Risk

InnovationStop Counting Vulnerabilities. Start Proving RiskByYonesy Nunez,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)Jun 01, 2026, 08:30am EDTDr. Yonesy F. Núñez is the CISO of Surf AI and a six-time CISO across financial services, fintech, and agentic AI. getty​For two decades, enterprise cybersecurity has run on a simple loop. Find the flaw. Name the flaw. Score the flaw. Fix the flaw. That loop is breaking, and most companies do not yet know it.Earlier this year, NIST formally acknowledged that the National Vulnerability Database can no longer keep pace with new submissions. Tens of thousands of CVEs are being moved to a “Not Scheduled” category. The pre-March 2026 backlog has been effectively abandoned. The agency is now triaging only what the CISA Known Exploited Vulnerabilities catalog flags, what federal software requires and what Executive Order 14028 designates as critical.For most organizations, that is not a footnote. It is the foundation. NVD enrichment feeds vendor scanners, the dashboards built on those scanners, the audit reports built on those dashboards and the executive narratives built on top of those audit reports. When the foundation cannot scale, every layer above it inherits the gap.This is happening at the same moment AI is industrializing vulnerability discovery. Frontier models have already validated hundreds of high-severity zero-days in production open-source code, including a Linux kernel bug that had been sitting unnoticed since 2003. Autonomous systems are topping bug bounty leaderboards. Research estimates that AI vulnerability research capability is doubling every four months.Discovery is no longer the constraint. Remediation is. And the gap between what we can find and what we can fix is widening every quarter.The Economics Were Broken Before AIEven before AI accelerated discovery,...