We are in a very dangerous time, when "AI" security companies are competing to prove that their technology will provide returns on investment. The industry has always been broken. There has always been an incentive to inflate the importance of vulnerabilities, but there was always a risk of burning hard earned trust. In the end, a lot of folks decided it wasn't worth it.
But "AI" companies haven't worked to earn that trust. They have something to prove, right now, or they don't exist. So now everything is critical, "impossible to find without AI," and so on. Blah2shell sells, and now everyone wants their little vuln labeled that way regardless of the complexity or risk.
Burning trust in security is the absolute worst thing you can possibly do in terms of tech. I'm worried about where things are going right now.
There have always been more bugs than we can fix. We've had to triage. If we break that, we flood maintainers until they burn out. Our job is not to fix everything. It's to filter information for the people who do.
But right now I'm reading vuln reports that aren't distinguishing between a 100% reliable and trivial exploit like log4shell and complex memory corruption bugs that are incredibly noisy and basically impossible to exploit with ASLR. ASLR is like 25 years old. You have to do better than a simple buffer overflow now to get a shell.
But people have shit to sell, so we have more noise. Again, "we've put the attenuator on the wrong side of the equation."