Why AI Vulnerability Detection Is Creating a Crisis of Judgment

The report, which analyzed 40,000 CVE lifecycles and Anthropic’s Claude Mythos model, reveals a sharp disconnect between automated discovery and real-world defense. While AI has slashed the cost of developing exploits to under $2,000, it has also introduced a high rate of error. Echo researchers found that fewer than 10% of the 23,019 candidate vulnerabilities identified by Mythos have undergone external validation, suggesting that AI is generating noise faster than humans can verify it.

This shift renders the traditional focus on detection obsolete. Data shows that CVE counts have surged 145% in two years, yet 89% of these vulnerabilities already have available fixes. The persistent danger is not a lack of intelligence, but a failure of execution: 40% of fixable vulnerabilities remain unpatched for over six months. Most successful attacks target these long-known issues rather than novel, AI-generated exploits.

Echo’s survey of 80 security leaders confirms this, with 37% identifying an inability to process their current volume of alerts as their primary obstacle. To address this, the company proposes a four-stage readiness framework—Exposed, Aware, Responsive, and Proactive—designed to help organizations pivot from merely scanning for problems to systematically closing the gaps that attackers actually exploit. As CTO Eylam Milner noted, the industry has spent years optimizing for detection, but judgment is the resource that simply does not scale at the pace of model inference.