LAS VEGAS — A leading security executive is calling for a move away from traditional patch management in favor of secure development practices, as AI fundamentally shifts the battlespace — and the economics — between malicious actors and network defenders.
AI is allowing attackers to discover and weaponize software vulnerabilities faster than ever before, and the most efficient way to combat that is to proactively build safer software, David Weston, corporate vice president for AI security at Microsoft, told attendees in a keynote address Wednesday at Black Hat USA.
“What we want to do is retrain the physics here,” Weston said. “We want to figure out where we can use this production advantage to actually turn the tables.”
Weston said for the tens of thousands of vulnerabilities that are documented, there are only 90 in-the-wild exploits every year.
Therefore most security breaches today occur outside of traditional security boundaries. Weston said the initial access method for most attacks involved credential theft, phishing or social engineering. However, in most cases, where vulnerabilities were exploited, they were known vulnerabilities.
The assumption that exploited vulnerabilities are scarce “is being undermined as we speak,” Weston said.
Weston said Microsoft Security Response Center is doubling the number of vulnerabilities being processed and patched every six weeks. The number of CVEs being processed per month has increased about nine times the volume of March, and that increased volume is heavily correlated to the rising use of AI.
Working exploits
After confirming a sharp increase in vulnerabilities, Weston examined whether these vulnerabilities are turning into actual exploits. Microsoft internal data appears to have confirmed that information.
MDASH, the company’s internal code-scanning harness, found more than 200 Linux kernel vulnerabilities in its internal Azure Linux distribution, Weston said. The company added an internal module that can turn a static analysis into a proof of concept. Out of the 200 vulnerabilities, researchers were able to automatically generate 182 PoCs. Weston said many of these are fully working exploits.
Weston referenced additional data from ExploitGym, a vulnerability benchmark, showing that out of 898 real-world vulnerabilities, about 157 working exploits could be generated.
He cited several examples of how attackers have used AI to automate their attacks, including an incident where hackers used Claude to target a Mexican water utility.
Weston agreed that, while AI enables attackers to be much more agile, there also are certain countermeasures that help defenders. He cautioned, what you don’t want to do is get into direct battle with attackers on their terms.
“Hand-to-hand combat with attackers will cause us to lose in defense,” Weston said during the keynote.
Shift left
Weston added that the industry can offset gains in attacker productivity by adopting secure-by-construction, formal verification and prevention before verification.
About 70% of vulnerabilities are related to memory safety issues and could be eliminated by using safer programming languages such as Rust. Part of the difficulty in fixing these problems has been the expense, according to Weston.
AI-based detection
In 2025, Microsoft Research introduced an AI-based project called RustAssistant, which uses large language models to help find and suggest fixes for Rust compilation errors.
A separate program from the Defense Advanced Research Projects Agency, called Tractor, is designed to automate the conversion of legacy C code into Rust.
