Malik Haidar has spent years navigating the high-stakes world of multinational cybersecurity, where he has witnessed the evolution of threats from simple scripts to sophisticated, AI-driven campaigns. As a specialist in integrating business perspectives into security strategies, he has long argued that the industry’s obsession with technical severity scores often blinds it to actual enterprise risk. In our discussion today, Malik explores how the arrival of advanced AI tools in 2026 is finally forcing a long-overdue shift from a reactive patching mentality to a sophisticated governance model. We delve into the critical distinction between severity and exposure, the influence of federal mandates like CISA’s Directive 26-04, and why the real bottleneck in security today is not discovery, but the complex human decisions behind prioritization.
AI is making vulnerability discovery and exploit development significantly faster and more scalable. How is this shift changing the fundamental premise of vulnerability management programs that have traditionally relied on severity scoring?
The arrival of advanced AI has fundamentally shifted the landscape by making vulnerability discovery and exploit development faster and more scalable than we ever imagined possible. For years, our programs operated on a fairly simple, almost mechanical premise: run a scanner, identify the bugs, rank them by severity, and patch them according to a set timeline. But today, that model is collapsing under the weight of AI-enabled tools that allow attackers to chain together low and medium-severity weaknesses into devastating attack paths with minimal effort. This ability to combine unremarkable findings cheaply and at scale means that a vulnerability’s severity score, when viewed in isolation, no longer tells the full story of the danger it poses. We are seeing a massive surge in findings from scanners, bug bounty programs, and attack surface management tools, creating a state of vulnerability overload that makes it nearly impossible to distinguish between a minor technical glitch and a direct path to our most critical systems.
You’ve mentioned that severity has never been the same thing as risk. Could you share an example of how relying solely on CVSS scores can lead an organization to make the wrong decision during a crisis?
The danger of relying strictly on severity scores is that they completely lack the business context necessary to make a smart decision. Imagine a healthcare organization where a vulnerability scanner flags a “critical” CVE on a laboratory instrument, but that instrument is tucked away on a segmented network with no path to the outside world. At the same time, there might be a “moderate” authentication bypass sitting on an internet-facing patient portal that handles thousands of sensitive records every hour. If the security team blindly follows the CVSS score, they might spend their weekend and valuable engineering resources patching a machine that is effectively locked in a vault, while leaving the front door to their most sensitive data wide open. Security professionals have understood these dynamics for a long time, but AI has lowered the cost for attackers to exploit these nuances, making context the most important input for any modern defense strategy.
Federal agencies are now moving toward a risk model based on specific questions about exposure and automation. How does this new approach, such as CISA’s Directive 26-04, change the way organizations justify their remediation timelines?
The shift we see in CISA’s Binding Operational Directive 26-04 is a major signal that the era of “patch everything critical immediately” is ending in favor of a more disciplined, evidence-based methodology. This directive replaces rigid deadlines with a risk model built on four pragmatic questions: is the asset publicly exposed, is the vulnerability known to be exploited, can that exploit be automated, and how much control does it actually grant an attacker? By expressly allowing agencies to defer action against low-risk vulnerabilities, the government is acknowledging that not all “critical” bugs are created equal. This creates a framework where a documented, risk-based rationale for why something wasn’t patched is more valuable than a massive, unprioritized backlog of tickets. It moves us toward a world where we can defend our decisions to regulators and boards based on the actual likelihood of a breach rather than just a technical score.
If the real bottleneck in cybersecurity is no longer discovery but prioritization, what role do business leaders and legal teams play in deciding which vulnerabilities warrant immediate action?
We have to recognize that vulnerability management has matured into a governance function where remediation decisions are inseparable from broader business risks. The real constraint on any mature program isn’t finding the bugs—it’s the finite availability of engineering resources, maintenance windows, and the need to keep revenue-generating platforms online. You cannot simply take a core business system offline during a peak period because of a theoretical vulnerability without having a serious conversation involving risk managers, legal teams, and business leaders. This is even more vital under current SEC disclosure rules, which require public companies to describe exactly how they assess and manage material cybersecurity risk. In a post-breach scenario, the courts and regulators won’t just ask if you patched your systems; they will ask if your decisions were reasonable and documented given the business priorities and the threat landscape at the time.
What is your forecast for the evolution of exposure management?
My forecast is that from 2026 to 2028, we will see the traditional concept of vulnerability management be completely swallowed by the broader discipline of exposure management and attack path analysis. Organizations will stop wasting time asking if a vulnerability is technically “critical” in a vacuum and will instead use AI to determine if that vulnerability is reachable, exploitable, and capable of causing meaningful harm to their specific operations. We are moving toward a surgical approach where the success of a security team is measured by how effectively they reduced material risk, not by how many thousands of patches they deployed. Ultimately, the programs that survive this new era will be the ones that recognize that security is not just a technical hurdle, but a fundamental pillar of corporate governance that requires a deep understanding of what truly matters to the business.
