Why Fixing Vulnerabilities Is Slower Than Finding Them, and How Automation Aims to Help

When a serious zero-day such as the recent PHP2Shell vulnerability emerges, security tools can flag affected production systems within minutes. According to Wiz Research, the harder part comes next: AI has sped up how fast vulnerabilities are found, but fixing them still depends on people coordinating with each other.

The problem is that security teams usually do not own the code, the infrastructure or the deployment pipelines. Fixing an issue means working with security, engineering and cloud or platform operations, and each group has different priorities. Security wants the risk gone immediately, engineering wants to keep shipping without breaking dependencies, and operations wants to protect uptime. Tickets bounce between teams, developers spend hours working out the right fix for their environment, and Mean Time to Remediation (MTTR) grows.

The article also points to a first hurdle: working out who owns the vulnerable asset. In multi-cloud, hybrid or AI environments, a container may have been deployed through a shared pipeline, built by someone who has since changed teams, or created with missing tags and an out-of-date asset database. Issues then sit unassigned or move between teams, delaying work before it starts. Wiz says its Green Agent tool addresses these bottlenecks. This is the opening of the piece, so the results it describes are not covered here.