# Automated Vulnerability Discovery Outpaces Manual Remediation ## Claim Automated vulnerability discovery creates an attacker window wherever remediation remains bounded by human review speed. <!-- atomicity: 1 idea ✓ --> ## Evidence > [!quote] > "AI now finds security holes at machine speed, but humans patch them at human speed." Akrites exists to close that speed gap by coordinating duplicate reports, maintainers, vendors, and public agencies around deployed patches rather than publication volume. ## Scope & conditions - **Holds** when discovery scales across many scanners while patch review and deployment remain manual. - **Strongest** for popular open-source dependencies that receive duplicate reports from unrelated scanners. - **Weaker** where a project has automated fixes, funded response staff, and fast downstream deployment. ## Links - [[3. Resources/Permanent Notes/AI Finds Exploit Chains Faster Than Humans Can Audit Them]] — the discovery-side sibling; that note covers human explanation of one chain while this note covers ecosystem-wide remediation capacity - [[3. Resources/Permanent Notes/Maintainer Attention Is the Scarce Resource in Open Source]] — vulnerability triage competes for the same finite maintainer attention as issues, reviews, and releases - [[3. Resources/Permanent Notes/An Open Marketplace Turns Extensibility Into Liability Without an Owned Security Layer]] — open ecosystems magnify the remediation gap when no funded party owns response across the catalog - [[3. Resources/Permanent Notes/Update Signatures Prove Provenance Not Freshness]] — downgrade resistance prevents attackers from reopening a fixed vulnerability with an older validly signed artifact - [[WordPress Hosting Security Stack MOC]] — the operational home for fast discovery, patch coordination, and update defenses ## Source - [[3. Resources/Readwise/Articles/Akrites Explained Open Source's New Emergency Team]] — machine-speed discovery, human-speed patching, duplicate-report overload, and patch deployment as the success metric. - [[3. Resources/Readwise/Articles/State of WordPress Security in 2026]] — earlier evidence that new WordPress vulnerabilities are weaponized within hours.