The bug queue is about to invert: budget for reachability data, not patch throughput

A vendor resource published by SC World argues that frontier bug-finding models are about to multiply vulnerability workloads past the point where current processes cope ^[1]. The consequence worth planning against is not the flood itself but where the bottleneck lands: if findings rise by orders of magnitude, the scarce resource stops being discovery and becomes the evidence that tells you which findings touch your estate.

The capability claims need caveats stated up front. The piece names Anthropic's Claude Mythos Preview and OpenAI's GPT 5.5-Cyber as models that can read source and fuzz binaries to surface memory-corruption bugs, injection weaknesses and authentication bypasses that conventional tools and human researchers miss ^[2]. Access to both is restricted to selected companies and researchers ^[3], so most defenders cannot reproduce anything. The most quotable data point, that Mythos produced a functional exploit kit for a 17-year-old remote-code-execution flaw in several hours, is an Anthropic test cited in a Tenable blog post and relayed by SC World ^[5]. Tests are also said to show the model chaining individually feeble flaws into critical working exploits ^[13]. That is two removes from primary evidence. The claim that comparably capable models will certainly become widely available, and will help attackers weaponise faster, is a forecast in the same piece, not a measurement ^[4].

Strip the promotional layer and one sentence is load-bearing. Tenable CTO Vlad Korsunsky writes that "a model that found a Linux kernel vulnerability cannot determine which of an organization's 50,000 Linux hosts are running the affected version without sensor-level access" ^[7]. That is the inversion in a line. Discovery is becoming cheap and general; the mapping from a flaw to your hosts, your versions, your paths and your business criticality stays local, private and expensive to maintain. Exposure management, as described, is that mapping work: asset discovery across IT, cloud, identity, AI and OT environments, plus evaluation against exploitability, business criticality and attack paths ^[8].

Tenable's own number makes the budgeting case better than its prose does. Contextual analysis, the company says, can narrow remediation to the 1.6% of vulnerabilities posing immediate risk ^[9]. That leaves 98.4% to be deprioritised ^[14] and implies roughly 62 judgements for every finding actually remediated ^[15]. That ratio, not the patch count, is what scales with discovery volume. The article concludes that discovery will no longer be scarce and that remediation capacity will be ^[12]; by its own arithmetic, triage capacity and the sensor data underneath it get hit first. Patch throughput only becomes the binding constraint once the filter is trustworthy, and the filter is only as good as the coverage behind it.

The five recommended actions read like a product tour: continuous asset discovery including shadow AI, replacing legacy scoring with aggressive risk filtering, attack-path analysis for toxic combinations, adversarial exposure validation, and agentic automation of remediation with human-in-the-loop approval for sensitive changes ^[10]. The first three are inventory and reachability work that pays off whether or not the predicted "Mythos moment" arrives ^[16]. The last is where an inaccurate asset graph turns into unplanned change.

What to watch: whether any exposure vendor publishes coverage and accuracy figures for its asset and reachability data rather than only its filtering ratio; whether the 1.6% claim ever arrives with methodology ^[9]; and whether restricted access to Mythos-class models holds ^[3]. Watch also for the 30-day patch cycle ^[11] becoming a reporting fiction while the real queue is unevaluated findings.