CISA Findings Renew Calls for Secure-by-Design Software as AI Speeds Up Vulnerability Discovery
Summary
CISA found that roughly 40% of vulnerabilities in its 2024 Known Exploited Vulnerabilities catalog stemmed from longstanding, preventable weaknesses. Experts warn that AI could speed discovery and exploitation, increasing the urgency of Secure by Design.
Key points
- CISA found recurring weaknesses—including memory-safety and input-validation flaws, injection, path traversal, and missing authentication—among exploited vulnerabilities.
- About 40% of vulnerabilities in CISA’s 2024 KEV Catalog were attributed to a handful of longstanding, preventable weaknesses.
- CVE disclosures more than doubled from FY2024 to FY2025, while the KEV Catalog grew by about 20%; attackers continued to focus on known flaws.
- Experts warn that AI can accelerate reverse engineering, vulnerability discovery, and exploit development, potentially shortening the time available to patch.
- Recommendations include making secure coding defaults easier to use and requiring vendors to demonstrate Secure by Design practices.
- Experts say Secure by Design should also address AI agents’ permissions and actions, as well as data integrity and provenance.
- The article cautions that secure-by-design products still need external security checks, including inspection of assembled software artifacts.
Article Details
- Event Type
- Reversing Labs reports on CISA's analysis of recurring software weaknesses in vulnerabilities listed in its Known Exploited Vulnerabilities Catalog and discusses how AI may accelerate vulnerability discovery and exploit development.
- Impact
- CISA's analysis found that roughly 40% of vulnerabilities in its 2024 KEV Catalog stemmed from a handful of preventable weaknesses. The article says CVE disclosures more than doubled from FY2024 to FY2025, while the KEV Catalog grew by about 20%. It warns that AI could increase the volume and speed of vulnerability discovery and exploitation, raising pressure on organizations to address recurring weaknesses and prioritize remediation.
People
Jacob KrellSenior director of secure AI solutions and cybersecurity at Suzu Labs; comments on vulnerability prioritization and Secure by Design.James McQuigganSecurity awareness advocate at KnowBe4; comments on using AI to support Secure by Design.Katie NortonDevSecOps and software supply chain security analyst with IDC; comments on trust and external security checks.Ryan McCurdyVice president at Liquibase; comments on AI agents, production-system changes, and software delivery security.Ted MiraccoCEO of Approov; comments on AI-accelerated vulnerability discovery and Secure by Design.Yasir ZahidCybersecurity leader and founding member of Secure.com; comments on secure development incentives.
Products
Common Vulnerability Scoring Systemvulnerability discovery scales up. “At AI speed, organizations still prioritizing by Common Vulnerability Scoring System (CVSS) scores instead of CISA’s newer Stakeholder-Specific Vulnerability CategorizationKnown Exploited Vulnerabilities CatalogSecure by Demand Guidechange are the buyers of software, not developers or security teams, he said, adding that CISA’s Secure by Demand Guide already lays this out. Enterprise customers and federal agencies can ask vendors whichStakeholder-Specific Vulnerability Categorizationby Common Vulnerability Scoring System (CVSS) scores instead of CISA’s newer Stakeholder-Specific Vulnerability Categorization (SSVC) framework won’t keep up,” he said.