The primary challenge in vulnerability management is no longer whether security teams can discover vulnerabilities quickly, but whether they can properly handle an increasing volume of findings before attackers exploit them. Microsoft believes that advanced artificial intelligence models will expand the scope of scanning, vulnerability discovery, and remediation design, but will also confront security teams with more findings than traditional human review processes were designed to handle.
The company says artificial intelligence enables defenders to detect exposures earlier and automate some remediation work, while simultaneously giving attackers faster tools for searching for and exploiting vulnerabilities. Therefore, measuring the success of a security program solely by the speed of issuing patches is not enough; organizations must maintain a balance between remediation speed and accuracy, while adopting controls that limit the impact of a breach when every vulnerability cannot be remediated in time.
What Is Changing in Vulnerability Management?
Microsoft uses advanced artificial intelligence models to scan its codebase and then reviews potential vulnerabilities for validity, severity, and impact before remediating them. It explains that some stages of vulnerability handling and disclosure are now supported by artificial intelligence, helping expand the scope of the process.
According to the company, Microsoft handles most cloud software vulnerabilities without customer intervention. Users of on-premises software, however, should expect a significant increase in the number of vulnerabilities announced in Tuesday updates compared with historical levels; September 2026 saw a record figure approaching 1,000 vulnerabilities.
Microsoft points out that models are nondeterministic and may produce different outputs when rerun or when another model is used. For this reason, the company uses a control layer, or “harness,” around the models that determines how they access code, validates their outputs, and connects the results to triage and remediation workflows. Microsoft has expanded the use of these layers across its engineering groups and has also made one of these tools, code-named MDASH, available to customers.
Practical Steps for Chief Information Security Officers
- Increase remediation resources: More resources should be allocated to remediating Microsoft on-premises software, triaging vulnerabilities, and determining their timing, given the expectation that update volumes will continue to rise.
- Shorten remediation time for critical systems: Microsoft suggests considering the application of fixes to components such as domain controllers and endpoints within 24 hours, rather than waiting for weekends or traditional maintenance windows.
- Use model control layers: Similar layers can be applied to control artificial intelligence tools’ access to code, validate results, and integrate them into remediation processes, without waiting for the latest models to become available.
- Allocate resources to human triage: An increase in the number of findings does not eliminate the need for experts to determine priorities, verify the accuracy of results, and address errors.
- Strengthen defense in depth: The status of critical security controls should be monitored because some vulnerabilities will not be remediated before exploitation.
Why Does This News Matter?
The actual change is the transition of vulnerability management from a limited-volume, periodic process to a continuous flow that may produce more findings than teams can examine manually. This increases the importance of triage quality and result validation as much as scan speed, and makes remediation timing an operational and security decision rather than merely a maintenance procedure.
Microsoft also points to the risks of the open-source software supply chain, explaining that it works with organizations in the industry to scan critical components and prioritize their remediation in coordination with their maintainers. The company presents the Secure by Design and Secure by Default principles as ways to reduce the burden on customers, with examples including mandatory multifactor authentication for Azure administrators, enabling soft delete in Azure Backup by default, and disabling default outbound access in Azure VNet.
Secure-by-Default Settings and Limitations
Microsoft recommends using Microsoft Baseline Security Mode, available to existing customers under the licensing agreement, to apply and monitor secure settings at scale. This mode enables controls to be turned on and off, exceptions to be managed, and deployment to be performed gradually, while its controls will be applied gradually by default to new Microsoft tenants.
These recommendations do not eliminate the need for risk-based decisions. Differences in model outputs, the possibility of inaccurate results, and the need for human resources and specialized triage are all limitations that make automation an aid rather than a substitute for governance and review. The source also does not provide detailed measurements of MDASH’s accuracy or the extent to which it reduces remediation time; these are areas that require independent evaluation before they can be considered proven results.