New vulnerabilities are discovered in code faster than developers can fix them. ​

Even daily reprioritization cannot keep up with hourly code changes. Reachability changes with every code changes and reachability detection tools cannot keep up.​

Cornell University researchers proved that GPT4 can now generate exploits for 87% of vulnerabilities given its CVE description.​ Source

If an attacker can load and execute vulnerable code, it does not matter that a developer did not call that function. It’s reachable! Whole groups of malware use this technique to breach organizations.​

3/4th of open-source critical and high vulnerabilities are unfixed. A developer can’t fix them, VM tools ignore them and DevSecOp teams give them a pass.​