AI speeds up vulnerability discovery, but enterprises struggle to fix risks: Cognizant

Artificial intelligence is allowing enterprises to identify cyber vulnerabilities at machine speed, but organisations are struggling to fix them at the same pace, causing risks to accumulate faster than they can be removed, Cognizant's global cybersecurity head Vishal Salvi told TNIE.

“Many organisations are accumulating risk faster than they can remove it. The challenge is not visibility. It is execution,” Salvi said.

He said AI had made vulnerability discovery faster, while remediation continued to be limited by business processes, testing cycles and operational considerations. This had created a gap between how quickly organisations could identify risks and how quickly they could address them.

“I often describe this as ‘machine-speed offence versus calendar-speed defence.’ That gap is becoming one of the defining cyber challenges of the AI era,” he said.

Salvi said AI had also become a new attack surface, with risks emerging around models, prompts, agents and autonomous actions. At the same time, organisations faced gaps in managing non-human identities, agent behaviour and accountability.

He said years of technology debt and security debt had left some organisations with environments where vulnerabilities reflected deeper architectural problems. AI was exposing those weaknesses and strengthening the case for modernisation.

“The next major shift will be applying AI to remediation itself, helping organisations prioritise, validate and resolve vulnerabilities faster,” Salvi said.

He said AI was already being used for vulnerability discovery, threat detection and investigation, helping security teams correlate signals, reduce noise and analyse incidents.

However, he said business-critical decisions still required human judgement and accountability. “The future is not fully autonomous cybersecurity. It is human-led, AI-accelerated cybersecurity, where AI handles scale and analysis while people remain accountable for decisions and governance.”

Salvi said the role of AI in cybersecurity was also changing how enterprises managed exposure. Frontier AI could identify relationships between vulnerabilities, technical debt, software dependencies and attack paths that were difficult to find manually.

He said this was driving a move from vulnerability management towards exposure management, where the focus was on how quickly and sustainably organisations could reduce risk.

For AI agents, Salvi said enterprises were increasingly treating them as digital employees, requiring identity, permissions, monitoring and accountability. Organisations were applying zero-trust principles to agents and increasing runtime monitoring because AI systems could evolve after deployment.

On rogue AI agents, he said the immediate concern was not malicious super-intelligent agents, but agents operating with excessive permissions, inadequate safeguards or poorly defined objectives.

“As organisations give agents access to applications, data and external services, mistakes or manipulation can have consequences at scale and speed,” he said.

He said organisations should not wait for AI risks to become clearer before acting, as AI adoption was already taking place through employees, software platforms and business workflows.

“Over the next two years, organisations will increasingly ask not whether an AI system is powerful, but whether it is trustworthy,” Salvi said.