Discovery outruns remediation while a certificate-authority failure shows trust itself breaking underneath application code

Discovery is winning, remediation is losing

ArmorCode's argument is simple: frontier AI models are increasing the speed of vulnerability discovery and attack-path analysis, and faster discovery shortens the time between disclosure and exploitation. The company says CTEM programs are struggling because discovery speed now exceeds remediation speed, and defines the exposure window as the length of time an attacker-relevant exposure remains open and exploitable. A finding only reduces risk, the company says, when the right owner takes the right action. Everything else is inventory. m:…7167

Axonius makes the same point from the defender's side: AI has made finding security flaws cheap, but AI has not made fixing security flaws safely any cheaper, and attackers use the same AI tools as defenders. The company cites Microsoft shipping 570 security fixes in July 2026, a record number the company attributed to AI-assisted discovery, and reports that the average time to exploit is now minus seven days. Defenders were slower than attackers on 88% of 52 actively exploited flaws. m:…9408

The patch-quality data sharpens the worry. Axonius cites a 2026 study of 6,080 AI-generated patches in which only 26% were clean fixes, while about half looked fixed but left the flaw exploitable. The company also reports that two critical flaws in the PHP runtime had existed for over a decade, that AI helped a researcher turn PHP flaws into working exploits in about a week, and that exploitation attempts for PHP flaws were reported within twenty minutes of the patch release. Speed without verification is not remediation; it is a faster way to produce the appearance of remediation. m:…9408

The process fix, and its limits

Both vendors point to the same process answer: prioritize by exploitability and business impact, not by severity scores alone. ArmorCode cites Gartner's September 2026 research advocating for time-based, decision-driven exposure reduction, and reports that only 48% of organizations prioritize exposures using likelihood of active exploitation and impact to business-critical assets, while 52% still rely primarily on technical severity such as CVSS. The company also reports that 45% of organizations reported using GenAI assistance or workflow automation, and 14% reported using GenAI agents, according to Gartner's 2026 survey. Those are vendor-cited survey numbers, but the gap they describe is plausible: most teams still sort by the score, not by the risk. m:…7167

Axonius adds a constraint the severity debate ignores: testing capacity. The company says Washington mandates a three-day deadline for the most dangerous flaws, and that shortening patch deadlines without adding testing capacity leads to skipped protective steps. Security leaders surveyed, the company says, do not measure their capacity to fix safely. That is the bottleneck in one line. You can mandate speed, and you can automate discovery, but if nobody measures how many fixes can be tested safely per week, the deadline just converts untested patches into production. m:…9408

ArmorCode's own product pitch follows from this diagnosis. The company says its Risk Graph correlates findings, assets, identities, ownership, business services, threat intelligence, reachability, exploitability, and criticality, and that its Anya Agents are designed to handle high-friction steps in the CTEM loop. The company also says it processes more than 400 billion findings annually, connects more than 425 security and development tools, and that its customers report a 75% average MTTR reduction, a 60% backlog reduction, and greater than 3X first-year ROI. The reconciliation tax of aggregating, de-duplicating, and normalizing data across siloed tools is real work, and it grows with discovery speed. m:…7167

When trust itself breaks

The eMudhra episode shows what happens when the failure sits below application code. ArmorCode reports that eight intermediate certificate authority keys run by eMudhra were generated with weak entropy, that the private keys could be recovered from public certificates, and that the weak P-384 key pairs were produced during a key generation ceremony on April 30, 2025. The private scalar keys evaluated to single and double digit integers below 256 instead of having 384 bits of entropy. A CA key compromise, the company says, is a system-wide failure of trust that sits below application code. No patch to your application fixes a broken trust root. m:…0508

The timeline is fast once discovered. ArmorCode says Mozilla confirmed the report and blocked the intermediates in Firefox on October 17, 2026, and that eMudhra revoked all eight affected certificates on October 18, 2026. The company lists fixed versions for remediation including Firefox 158.0.1, Go 1.26.10 or 1.27.3, and certifi 2026.10.19, and says rebuilding Go binaries and container images is required to apply trust store updates. Blocking the eight public keys in proxies or gateways, the company says, covers both eMudhra and Sectigo cross-signed certificates. Chrome expects to remove the emSign ECC Root CA - G3 root on October 27, 2026. m:…0508

The commercial ending came days later. Open Source China reports that eMudhra announced its decision to voluntarily exit the global SSL/TLS certificate business on October 22, 2026, after Mozilla, Google, and Apple blacklisted eMudhra's CA on October 21, 2026. The company denies that its infrastructure was compromised during the incident, says no end-entity certificates were issued from the affected CA, and says it revoked the affected CA within 14 hours of the incident. The global SSL/TLS business accounts for approximately 1% of eMudhra's total revenue, and the company says it will provide free certificate replacements to affected customers through partners. The lesson for everyone else is to inventory where trust roots live in your own stack, because that inventory is the remediation plan. m:…9746