Recent disclosures from the financial sector have highlighted a significant moment in modern cybersecurity. Bank of America deployed one thousand outside contractors, working alongside three thousand existing technology staff, to address software vulnerabilities exposed by advanced frontier artificial intelligence models, including Anthropic’s Mythos. This remediation effort contributed to expenses reaching hundreds of millions of dollars in a single quarter.
While the speed at which artificial intelligence can inspect software code is remarkable, this situation highlights a crucial operational reality: finding software flaws using automated tools is relatively fast, but remediating those flaws still requires significant human labour, contextual understanding, and substantial financial investment.
The Discovery Paradox: Detection Versus Remediation
Advanced artificial intelligence models are capable of processing millions of lines of source code in fractions of the time required by traditional methods. They can identify patterns, uncover hidden weaknesses, and compile extensive lists of potential flaws. However, vulnerability discovery represents only the beginning of the security journey.
Once an artificial intelligence tool flags thousands of potential issues, the automated process effectively ends. Every single finding must then be triaged by human engineers who understand the operational environment. Technology teams must determine:
- Whether the identified vulnerability represents a genuine threat or an unexploitable false positive.
- How a proposed code modification might affect the stability and performance of surrounding systems.
- How to schedule, test, and deploy software updates across critical enterprise infrastructure without causing operational downtime.
In the case of Bank of America, artificial intelligence provided rapid detection, but resolving those issues required four thousand professionals and hundreds of millions of dollars. Automation can accelerate the identification of flaws, but human expertise remains indispensable for delivering secure, functioning software solutions.
The Economics of Security: Was There a More Cost-Effective Approach?
The expenditure of hundreds of millions of dollars on emergency contractor remediation prompts an important question regarding security economics. Could an organisation achieve comparable, or even superior, security outcomes for the same financial outlay by investing earlier in thorough, human-led code reviews and regular penetration testing?
When organisations rely on automated sweeps to uncover a backlog of vulnerabilities all at once, they often face a reactive crisis. This approach can lead to:
- High Emergency Remediation Costs: Engaging hundreds or thousands of temporary contractors under tight timelines commands premium rates.
- Alert Fatigue and Triage Inefficiency: Automated scans can generate large volumes of theoretical vulnerabilities that demand substantial time to review, even if many pose negligible operational risk.
- Disruption to Strategic Projects: Internal engineering teams must pivot away from product development to manage emergency patching workflows.
In contrast, structured human code review and routine penetration testing allow experienced security specialists to evaluate software in its proper business context. Human security professionals do not simply identify potential vulnerabilities; they assess whether a flaw can realistically be exploited and advise on practical remediation. Distributing this expenditure consistently over the development lifecycle can prove significantly more cost-effective than managing an urgent, large-scale patching initiative.
The Root Cause: Insecure Legacy Code and Developer Education
The scramble to remediate software vulnerabilities points to an underlying issue shared across global industries: technical debt and the challenge of secure software development.
Historically, most software developers have been educated and incentivised to prioritise feature delivery, speed to market, and user experience rather than defensive coding practices. In addition, large organisations across Australia, the United Kingdom, and the United States often maintain complex legacy systems built years or decades ago, long before contemporary security standards were established.
When frontier artificial intelligence models are directed at these vast repositories, they do not create new flaws; they merely expose the technical debt that has accumulated quietly over many years. Relying solely on automated discovery tools to locate this debt without addressing how code is written simply perpetuates an expensive cycle of patching.
Practical Strategies to Address Software Security Debt
Organisations seeking to manage their technical debt and improve their defensive posture can consider implementing several proactive measures:
- Invest in Secure Code Training for Developers: Providing development teams with targeted training on defensive engineering principles can assist programmers in identifying and avoiding common security pitfalls before code ever reaches production.
- Conduct Regular Human-Led Penetration Testing: Engaging qualified penetration testers provides a realistic view of how malicious actors might exploit combined vulnerabilities, delivering actionable intelligence rather than raw, unvetted automated alert data.
- Adopt Risk-Based Vulnerability Prioritisation: Rather than attempting to remediate every minor automated alert simultaneously, organisations can focus resources on flaws that present demonstrable risk to sensitive data and critical systems.
- Integrate Security Reviews Early in the Development Lifecycle: Reviewing system architecture and code during the design and development phases helps reduce the financial burden of resolving flaws late in the deployment cycle.
Enhancing Your Security Posture with Vertex
Managing software vulnerabilities and legacy technical debt does not have to result in emergency measures or unexpected financial strain. Proactive planning and expert guidance can assist organisations in establishing sustainable security practices.
Vertex Cyber Security provides expert penetration testing, comprehensive cybersecurity audits, and targeted training programmes, including secure code training for developers. Our experienced specialists work collaboratively with your team to deliver hand-vetted, prioritised assessments that clearly distinguish genuine operational risks from theoretical alerts, accompanied by practical remediation guidance.
To discuss how Vertex can support your organisation in managing technical debt and strengthening your cybersecurity defences, contact our team directly at .