Why Do Companies Need Fewer People as AI Becomes More Powerful? A Single Vulnerability Fix Can Mobilize Hundreds of IT Employees

AI is significantly accelerating the discovery of vulnerabilities, but the real headache for companies occurs after scanning.

Source: Jin10 Data

AI accelerates the discovery of software vulnerabilities, yet some companies are increasing security positions and budgets. According to a report by The Information this week, global IT service provider Diversified plans to increase its security software budget by about 20% over the next year and hire at least three full-time cybersecurity personnel.

The scale of the repair work explains this additional expenditure. The New York Times also reported that a recently disclosed PHP vulnerability requires modifications to about 200 files. After researchers identified the issue, multiple companies spent weeks coordinating with open-source maintainers to fix it, then notified relevant agencies to assist in deploying the patch.

Emergency Fixes Occupy Daily Development Staff

Diversified recently mobilized most of its approximately 100 IT employees when addressing vulnerabilities in PHP and the Brotli web traffic compression library. Participants included analysts and engineers who do not usually work directly in security, as they needed to investigate which cloud applications and web pages might be affected and install patches.

The company's Chief Information Officer told The Information that the work involved in the repairs far exceeds a simple update and is encroaching on daily operational time. The company's planned increase in security software spending includes AI tools capable of automatically monitoring applications; the new personnel will be dedicated to addressing actual repair needs.

Startup company Atomicwork also experienced a concentrated inspection. CEO Vijay Rayapati requested about 30 software engineers to pause their current work last week to prioritize cybersecurity issues. The company ultimately confirmed that it was not directly affected by related threats but still invested manpower in the inspection.

Rayapati plans to hire one cybersecurity engineer for every three technical employees recruited. He expects the number of engineers focused on cybersecurity to increase to about 27 over the next year, nearly tripling from the current number. This is part of the company's hiring plan, which has not yet been fully implemented.

After Finding Vulnerabilities, There Are Confirmation, Repair, and Deployment

The New York Times' report on the PHP repair process shows that researchers from the security company Calif began using AI agents to check this programming language in July and discovered vulnerabilities that had been hidden for over a decade. They then contacted PHP maintainers and the Wiz team, which had discovered similar vulnerabilities, to jointly advance the repairs.

Participating engineers collaborated through dedicated communication channels and coordinated daily calls. As the patch neared completion, the team also notified government agencies and the internet infrastructure company Cloudflare to help expand the deployment scope. After detection output, code modifications and inter-agency coordination still require time investment.

Open-source maintainers also need to first determine whether the reports are valid. The New York Times pointed out that since the end of last year, some projects have received a large number of AI-generated vulnerability reports that were not adequately tested, as well as valuable findings. According to data from the OpenJS Foundation, Node.js has confirmed and repaired 50 vulnerabilities this year, more than in any previous year.

There remains a gap between vulnerability disclosure and successful attacks. Axios reported this week, citing security researchers, that while recent PHP vulnerabilities have triggered numerous attack attempts, the difficulty of constructing effective attacks is high, with limited successful cases, and corporate defenses have played a role.

Scanning Bills Prompt Companies to Seek Lower-Cost Models

In addition to expanding security teams, AI scanning itself is also an expense. Scott Roberts, Chief Information Security Officer of enterprise software company UiPath (PATH.N), told The Information that using Anthropic's Mythos to scan a codebase costs about $25,000; the company has hundreds of codebases and has recently reduced such expenses through cheaper open-source models.

Morgan Stanley's research report on Monday linked low-cost models to security work. The firm believes that open-weight models are expected to reduce costs for processing operational data such as logs, alert investigations, threat classification, and automated responses; customers or competitors may also use these models to replace some security functions that would otherwise require additional payment.

The report also noted that lower inference costs could lead to increased usage, with savings ultimately retained by either software vendors or customers, depending on competition and pricing methods.

The Information also interviewed the Chief Information Security Officer of a large U.S. energy company. This individual stated that the company's cybersecurity budget, based on about $30 million, has increased by more than 10% this year compared to last year, with additional spending allocated for AI add-ons for Mythos and existing security products.

The company's existing email protection and data monitoring tools charge separately for continuously running AI functions. To pay for the new features, the company has already tapped into next year's cybersecurity budget early.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.