Authored by: Patrick Schoutens  CTO, Dev Architect, Autonomos AI.

There is a narrative developing in cybersecurity that deserves to be challenged.

Microsoft has just delivered the largest Patch Tuesday in its history, addressing approximately 974 vulnerabilities across its own products. Hundreds affected Windows, more than a hundred affected Office, a significant number were classified as Critical, and two vulnerabilities were already being actively exploited.

Increasingly, however, the explanation surrounding extraordinary numbers like these is becoming AI. AI is finding vulnerabilities faster. AI is changing vulnerability discovery. AI means we should expect larger Patch Tuesdays. All of that may be true, but we need to be extremely careful about the conclusion we draw from it.

That distinction matters enormously.

Microsoft itself has effectively acknowledged this. Its own security teams have explained that advanced AI models are now surfacing additional weaknesses in code that has already been examined extensively because AI can analyse software at a speed, depth and consistency that was previously impossible through human review alone.

That should not be interpreted as an indictment of AI. It should force us to confront what AI is actually finding. If an advanced security system examines a mature software platform and uncovers hundreds of exploitable weaknesses, the uncomfortable question should not be, “What has AI done to cybersecurity?” The question should be: why were those vulnerabilities there in the first place? Discovery is not causation.

If medicine introduces a better diagnostic system and suddenly discovers diseases that were previously being missed, nobody seriously argues that the diagnostic technology created the disease. We recognise that visibility improved. Cybersecurity requires the same intellectual discipline.

AI-assisted vulnerability discovery is beginning to expose

accumulated security debt at a scale that traditional

processes were simply incapable of seeing.

In that respect, the increasing effectiveness of AI vulnerability research is one of the strongest arguments for applying AI more aggressively to software security, not for blaming it when uncomfortable results emerge.

Microsoft’s own security research supports that conclusion. Its work with multi-model and multi-agent vulnerability discovery demonstrates that artificial intelligence can analyse source code, configuration, identity relationships, attack paths, network topology and runtime conditions at enormous scale. Microsoft has reported very high validation rates for findings generated through these systems.

There is, however, another part of this discussion that the industry should not avoid.

Microsoft is one of the largest and most technically capable software companies in the world. It has enormous engineering resources, exceptional security researchers, sophisticated development pipelines and one of the largest vulnerability-response operations on the planet. And yet customers were presented with a Patch Tuesday approaching one thousand vulnerabilities in a single release cycle.

We should not simply normalise that.

The rest of the software industry would not necessarily be afforded the same tolerance. If a smaller security vendor repeatedly released software requiring hundreds upon hundreds of vulnerability fixes, very serious questions would be asked about its architecture, engineering discipline, secure-development practices, technical debt, testing processes and quality assurance. In many enterprise or government procurement environments, a much smaller vendor could find itself excluded, subjected to remediation requirements or removed from consideration altogether for a fraction of that exposure.

That makes the contradiction even harder to ignore. We are living in an era in which large enterprises and governments have embraced Zero Trust as a foundational security principle, yet some of the most deeply embedded software inside those same organisations comes from vendors whose products can require hundreds of security corrections in a single release cycle. Smaller technology companies are routinely expected to prove their security posture, justify every weakness and demonstrate rigorous controls before they are trusted inside these environments. The largest incumbents should not be judged by a fundamentally different standard simply because their software is already everywhere.

Scale explains complexity.

Legacy explains complexity.

Compatibility requirements explain complexity.

But none of those should become a permanent exemption from engineering accountability.

If Zero Trust is genuinely the standard, then the principle should apply consistently, including to the software vendors on which governments and major enterprises have become most dependent.

This is where I believe the cybersecurity industry is in danger of creating another sacred cow. We increasingly hear that there are not necessarily more vulnerabilities; AI is simply discovering more of them. That may well be true. But that statement cannot be allowed to end the conversation. If AI is capable of repeatedly discovering enormous numbers of exploitable weaknesses, the logical response is not merely to become better at processing and publishing those discoveries. The software-development model itself must evolve.

It should be continuously interrogating software before vulnerabilities reach the customer, not simply helping vendors explain why the next patch cycle is even larger than the previous one.

The objective cannot be to become extraordinarily efficient at producing enormous collections of patches. The objective must ultimately be to reduce the number of serious vulnerabilities that reach production at all.

To Microsoft’s credit, there are clearly people inside the company who understand precisely this. Microsoft’s Secure Future Initiative is built around principles such as Secure by Design, Secure by Default and Secure Operations. Microsoft is investing heavily in AI-assisted code analysis, vulnerability validation and proactive defence.

Those are the right directions. But the success of AI-assisted vulnerability discovery should never obscure the engineering lesson contained within these numbers.

There is also another side to artificial intelligence that cannot be dismissed: AI itself can introduce entirely new attack surfaces. Once a model is connected to credentials, databases, applications, APIs, infrastructure, tools and execution environments, it is no longer merely generating language. It becomes part of an operational system capable of influencing or initiating consequential action. That changes the security problem fundamentally.

An agent that can reason, select tools, access sensitive information and request execution requires a level of governance that traditional application security was never designed to provide. Microsoft’s own security research has demonstrated how weaknesses around AI agents and tool-connected systems can convert seemingly innocuous prompt manipulation into very real execution risk.

An AI system may observe what is happening. It may detect abnormal behaviour. It may investigate an event, correlate information, reason about consequences, recommend a response and even construct a plan. But the ability to take consequential action should sit behind explicit policy, contextual decision-making, bounded authority, validation, governance and preserved evidence. That becomes even more important as organisations move toward agentic systems capable of acting with increasing independence. Security can no longer be treated simply as a collection of alerts followed by a human analyst deciding what to do next.

We are now in an environment where machines are increasingly making decisions at machine speed. The question therefore becomes much larger than vulnerability detection.

The real questions are who is allowed to decide, who is allowed to act, under what circumstances, against which assets, using which authority, for how long, and with what evidence preserved afterwards.

We believe AI should be used aggressively to interrogate software, continuously red-team architectures, identify attack paths humans miss, analyse runtime behaviour and correlate identity, application, infrastructure and behavioural signals at a scale that conventional security tooling simply cannot achieve.

We should use it to shorten the distance between detection, understanding and remediation. But, critically, we should also use it during engineering so that fewer vulnerabilities ever reach production in the first place.

The arrival of AI should raise the software industry’s security standard; it should not lower our expectations of the software itself. This ultimately leads to something larger than vulnerability management.

Digital Sovereignty does not mean the absence of threats.

That world does not exist.

It means organisations retaining meaningful control over their infrastructure, their data, their intelligence, their policies, their authority and ultimately the decisions being made within their digital environments.

It means reaching a state in which organisations no longer have to live permanently on edge, overwhelmed by thousands of alerts, endless patches, disconnected security products and the constant uncertainty of whether something important has been missed.

It means having an intelligent system continuously observing the digital environment, understanding what is happening, assessing what matters, applying policy, controlling authority and responding appropriately within clearly defined boundaries.

It means giving people confidence that their digital environment is being watched, understood and governed even when they are not staring at another dashboard.

That is the real opportunity artificial intelligence presents to cybersecurity.

Not simply more alerts.

Not simply faster vulnerability discovery.

Not another generation of security tools demanding even more human attention.

But the possibility of private, sovereign systems capable of carrying more of the cognitive and operational burden themselves while preserving human authority where it matters.

A Patch Tuesday containing close to a thousand vulnerabilities should therefore not lead us to conclude that artificial intelligence has somehow made cybersecurity worse.

It should provoke a much harder question: Now that AI can see this deeply into our software, are we prepared to confront what it is showing us—and build systems capable of doing something intelligent about it?

Because discovering the problem is only the beginning. The real objective is control.

Digital Sovereignty is what gives an organisation ownership and control of its digital environment. And when that sovereignty is combined with intelligent, continuous and dependable decision and control, the outcome we are ultimately designing for is Digital Serenity.

Autonomos AI

Autonomous Intelligence, Decision & Control

Sovereign by design. Building toward Digital Serenity.

#CyberSecurity #ArtificialIntelligence #AI #Microsoft #PatchTuesday #SoftwareSecurity #ApplicationSecurity #AgenticAI #SecureByDesign #AutonomousSecurity #DecisionIntelligence #DigitalSovereignty #DigitalSerenity #AutonomosAI