HPE: Cybersecurity's Real Bottleneck Is Remediation, Not Risk Detection

AI changes how weaknesses are found

HPE describes the first part of the cybersecurity challenge as inconsistent risk discovery and prioritization. It says this stems from the limited time and expertise needed to analyze complex systems and code, evaluate compensating controls and decide whether a weakness poses a real risk.

According to HPE, AI changes that equation. It can analyze complex code bases and surface non-obvious defects at a speed and scale that were previously impractical. The company stresses that discovery is only the beginning: findings must still be reproduced, validated, assessed, remediated, tested and communicated before customers can be protected.

HPE says it was one of the initial organizations invited to test Anthropic's Mythos Preview, which it calls the first frontier AI model developed for vulnerability discovery. Fast access to that model and later frontier models led HPE to build advanced security harnesses and a multi-model approach, according to the post.

What HPE says it means for customers

HPE says the outcome for its customers is tangible: weaknesses can be addressed before misuse, fixes can be built into software updates, and mitigation and remediation guidance is delivered through established security advisories and support channels.

The company says every finding still goes through human validation, severity assessment, risk-based prioritization, remediation and testing. In its words, AI increases the reach and speed of the work without lowering the standard of proof. Initial efforts focused on HPE's existing code base, and the company says applying frontier AI models to vulnerability detection will become an important part of its secure product development lifecycle.

Three steps to shorten the path to action

The second part of the challenge, HPE writes, is risk mitigation and remediation. As AI-assisted discovery raises the volume and urgency of findings, it says organizations must prepare to compress the path from advisory to action. It lists three practical steps:

• Stop waiting for vulnerability reports. HPE says teams that wait for security staff to run scans and report what needs fixing are following an unsustainable model. It recommends subscribing to vendor security bulletins, mapping advisories quickly to the environment and treating automated mitigation as critical, which may require re-architecting significant tech stacks.
• Accelerate change management. The time from vulnerability to exploit has shrunk, HPE says. Organizations should define how critical advisories are triaged, who can authorize emergency maintenance and how updates move through validation and deployment within hours, not days or weeks. In some cases this may mean strict mitigating controls to lower exposure, and HPE acknowledges there will always be business tradeoffs.
• Reduce unnecessary complexity and tech debt. Highly customized environments can take longer to patch and test. HPE urges simpler architecture, moving off end of life and end of service technology immediately, and getting a handle on asset inventories and the software supply chain.

Fundamentals still apply

HPE argues that AI lowers the cost and expertise needed for both attackers and defenders to find weaknesses, and that the interval between discovery and operational risk will keep shrinking. The fundamentals remain intact, it says: secure development, human validation, risk-based prioritization, timely remediation and coordinated disclosure.

The company also calls zero trust a particularly effective foundation. Continuous verification, least-privilege access, segmentation and rapid containment reduce the chance that one vulnerability becomes a broad compromise, according to the post.

HPE says Project Glasswing kickstarted a future in which AI helps providers find weaknesses sooner and deliver more resilient products. For customers, it says, that means earlier action, established channels for updates and recommended actions, and infrastructure designed to limit the impact of threats that cannot be prevented. HPE concludes that organizations that learn to use frontier AI safely and aggressively will have the advantage, and says it intends to be one of them.