The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience

OPINION

An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience.

Every year, the lexicographers at Merriam-Webster officially add new words or word usage to the dictionary. It’s a fascinating process, outlined here. In 2009, a new usage of the word “tweet” was added to describe a social media post from the microblogging site then known as Twitter. “App” was added in 2010 to describe application software. And, in 2025, the word “slop” was amended to include AI slop, mass quantities of content created using generative AI. Watching our language and usage evolve gives us a glimpse into the zeitgeist.

When we reflect on 2026 and cybersecurity, what will the word of the year be? Without a doubt, the word of 2026 will be “vulnerability” or its plural “vulnerabilities.” Think back to RSAC 2026, when the consensus post-conference was that the industry is suffering in a sea of sameness, and cybersecurity is a mature market that will be consolidated, commoditized, and monitored as a cost center.

Then, on April 7, 2026, along came the public disclosure of Anthropic’s Claude Mythos, and the word “vulnerability” was the topic of conversation for everyone from CEOs to pundits to security researchers. The industry launched into a full fear, uncertainty, and doubt (FUD) campaign, with the “vulnpocalypse” being declared. The conversation suddenly became about the sheer number of vulnerabilities that could be exposed and the attacks that could happen at scale. The industry is conflating vulnerability volume with risk, and that confusion is costing cybersecurity professionals credibility.

Fast forward six months and the world is still standing despite the record-setting number of vulnerabilities reported. In mid-September, CISA announced that over 67,000 Common Vulnerabilities and Exposures (CVEs) have been published; it anticipates 2026 will end with 96,000 new vulnerabilities.

Vulnerabilities Have Always Been With Us

The reality is that vulnerabilities have always existed in everything ever built by human beings. And vulnerabilities will continue to exist. Just because a vulnerability exists does not mean it’s a risk. To pose a risk, vulnerabilities must be acted upon by a threat. The threat can be in the form of a cyberattack, a human error, or a natural disaster.

So, yes, agentic AI is absolutely allowing vulnerabilities to be discovered more quickly, but does the existence of a vulnerability mean it absolutely has to be remediated? No, not at all. Discovery is not exploitation, and exploitation is not impact. Imagine the credibility surge and reputational impact to the CISO when comments to the board change from “we have 15,000 open vulnerabilities” to “we reduced exposures on the three systems that drive 75% of our revenues.” This is the type of language that shows leadership, alignment, and a focus on resilience and outcomes.

The fear being driven by the vulnpocalypse was ignited by the frontier AI companies, and cybersecurity companies followed the lead. It is now up to the cybersecurity community to move away from FUD and show leadership. The cybersecurity industry, including vendors, security teams, media, and analysts, needs to act in unison to protect the field — meaning, question the hype. We all must focus on ensuring cybersecurity to protect the business, the ideal we have spent decades building. AI increases the speed of vulnerability discovery. That is powerful. Prioritizing remediation based on business impact is the definitive goal.

The industry has weathered risks in the past and come through because of disciplined remediation strategies, communication, and setting expectations. Think of Y2K and the rigor behind timely and effective remediation. Y2K was not a hoax and was successful because of prioritization and business impact communication. As an industry, we must lead with credibility, communication, and clarity.

Innovation Speeds Remediation of Vulnerabilities

In the spirit of protecting the field, we are seeing innovation from existing cybersecurity vendors to accelerate remediation of vulnerabilities, provide guidance on remediation, and assess business impact. New vendors are entering the market with funding mandates to build solutions for the AI era. Recent Omdia research shows 87% of organizations are seeking new tooling built for the AI era.

Security teams need to take this opportunity to position themselves as being in the business of outcomes, not cataloging and counting vulnerabilities. Change the conversation with the C-suite and board from the tactical concern about vulnerabilities to the real business discussion of managing risk and cyber resilience.

Building a cyber-resilient organization requires three elements. Security teams and the line of business need to be aligned. AI must be part of the defensive and offensive security strategies. And every stakeholder needs to coalesce and understand their role in the event of an unforeseen outage of the IT estate.

It is time for the cybersecurity industry to lead with conviction, deliver outcomes, and emphasize cyber resilience.

Vulnerability may be the word of 2026. Let’s be strategic in our thinking and make resilience the word of 2027.

Read more about:

Opinion