COMMENTARY: In just 18 months, AI systems have moved from barely performing entry-level security tasks to autonomously discovering and exploiting vulnerabilities across open-source and production environments.As open-weight models close the gap with frontier systems, AI-driven vulnerability discovery has rapidly expanded. It’s become accessible, affordable, and routine, ushering in a new era of AI for security.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]However, a growing remediation deficit has emerged. While discovery accelerates, the ability to fix what’s found has not kept pace, creating a widening gap between exposure and resolution.We’ve already seen this deficit play out. At DEF CON 32 Semifinals, AI systems advanced in just one year, moving from partial effectiveness to near-systemic capability, by identifying the majority of planted vulnerabilities while also surfacing previously unknown real-world issues at low cost.These capabilities are no longer isolated or experimental. The math has fundamentally changed, and the remediation deficit has become a defining constraint on security itself, in an era of AI-driven security operations.It’s clear we’re doing business in a dense vulnerability landscape. Vulnerabilities appear throughout complex systems and require approaches that account for that density. Today, we have to keep pace with the speed and scale of discovery across organizational, technical, and economic systems, while continuously reducing exposure.Our industry will shape the next phase of cybersecurity by how effectively we evolve remediation to match a world where continuous discovery continues to expand.Nidhi Aggarwal, chief product officer, HackerOneSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial. The illusion of scarcity Security teams have traditionally assumed that