Will there come a day where there are 0 vulnerabilities to find?

‍

There's an interesting potential for AI to remove a lot of the traditional sources for vulnerabilities. Building really mature models of AI that are capable of generating code without human error presents great opportunity. However, the likelihood of us ever seeing a day where code is being written without any vulnerabilities being introduced into systems is slim.

‍

Vulnerabilities are sometimes coupled with features, and you sometimes have to accept that risk in order to implement a feature and enable a system to do something. This is simply an unfortunate reality within cybersecurity.

‍

It's a hard pill to swallow for security people. Penetration testers in particular like to think that every vulnerability they report is going to be triaged, treated and remediated, but that's not realistic. The reality of the tradeoff between security and usability in any product and in any situation is that vulnerabilities may remain in spite of detection.

‍

Thus, even if AI is capable of writing impeccable code that prevents new vulnerabilities from getting in, the features we will continue to use and work with will inevitably invite vulnerabilities into the system.