THE article argues that the industry’s obsession with vulnerabilities has crowded out focus on resilience. It notes that, after a flurry of high-profile disclosures and a wave of commentary in 2026, the narrative shifted from “vulnerability volume” to a broader concern about risk and business impact. By mid September 2026, CISA reported more than 67,000 published CVEs, with expectations that the year would close with around 96,000 new vulnerabilities.
The piece emphasises that simply having a vulnerability does not equal risk; risk requires exploitation or other adverse action by a threat, mistake, or disaster. AI is speeding up discovery, but discovery does not automatically entail remediation or impact. The author warns against equating vulnerability counts with organisational health or credibility.
The piece advocates reframing security from counting weaknesses to delivering outcomes and resilience. It highlights three elements for building a cyber-resilient organisation: alignment between security teams and the lines of business, the integration of AI into both defensive and offensive security strategies, and clear roles for all stakeholders in the event of an IT outage.
The author names ongoing innovation from vendors and the emergence of new tooling aimed at the AI era, urging security leaders to prioritise remediation based on business impact rather than mere exposure counts. The overarching message is for the industry to lead with credibility, focus on resilience, and shift conversations with boards from vulnerabilities to risk management and business continuity.