[Interview] “In an Era When Anyone Can Be a Hacker, the Vulnerability Flood Means We Have to Survive Through Selective Response”

With the spread of AI lowering the barrier to vulnerability discovery, even nonexperts can now detect system flaws with simple instructions, Boris Larin, a senior researcher at Kaspersky GReAT, said. In an interview with this paper at the Security Analyst Summit 2026 (SAS 2026), held last month in Bali, Indonesia, Larin explained this shift as the backdrop to his view that we are entering an era in which anyone can become a hacker.

By contrast, the pace of security patch deployment has stagnated, and the time gap between vulnerability discovery and patching is actually widening, Larin noted. He said that if vulnerabilities are in the tens of thousands, patching speed must keep up accordingly, but the time required for patches is not being shortened by AI alone.

As the gap between discovery and action continues to grow, the risk of organizations and institutions being left exposed without protection is also increasing, Larin said at SAS 2026. In the interview, he stressed that amid a flood of vulnerabilities, the current phase is one in which organizations must endure through selective response rather than handling every issue uniformly.

Larin is an expert who has identified multiple APT attacks and has discovered more than 20 Zero-day vulnerabilities, and he works as a Kaspersky researcher. He said his journey into hacking began with Sony’s game console, the PlayStation 3 (PS3). As a child, he got his hands on a PS3 out of curiosity, studied it for years, and eventually found a way to hack it.

Larin said AI shortens the time needed to search for vulnerabilities and lowers the experience barrier to vulnerability research. He said that in the past, vulnerability research required years of experience and thinking that broke with conventional assumptions, but now all of those capabilities are no longer essential. He also said that AI models can be sufficiently guided with just a short prompt.

Kaspersky is developing its own agent for applying AI models to research, and is also developing a Harness environment for managing model tool use and execution. Larin said those agents have recently discovered several vulnerabilities. Those vulnerabilities will be officially disclosed after patches are completed.

As AI advances, vulnerabilities are surging. So far this year, the number of publicly disclosed CVEs has reached about 90,000, nearly double last year’s 48,449 publicly disclosed CVEs. But patching speed is not keeping pace with this rise in vulnerabilities.

Developers must go through a process of verifying that no new errors are introduced after creating a patch. They also need to conduct advance compatibility testing across a range of system configurations before releasing the patch. If this is neglected, applying a patch in the name of safety can end up paralyzing the entire system.

Larin said Microsoft (MS) is also cautious about releasing emergency patches outside of Patch Tuesday, even when there are reports of real-world exploitation threats. He cited the need for advance compatibility testing across numerous system configurations as the reason. He also said that even AI-based patch automation cannot solve the verification process itself.

In the era of Bug Flood, Larin stressed that when vulnerabilities are pouring out in large volumes to those responsible, patches should not be treated all the same; instead, response priorities must be set according to risk and type. He suggested referring to CVSS (Common Vulnerability Scoring System) scores as a way to preemptively address high-risk vulnerabilities, and said vulnerability type is key information in determining priority.

Accordingly, Larin said responses should be guided by both CVSS scores and the nature of the vulnerability. In particular, he explained that remote code execution (RCE) vulnerabilities should be patched first because they can compromise a system without authentication at the network boundary, such as through a virtual private network (VPN). By contrast, local privilege escalation (LPE) vulnerabilities carry the risk of stealing administrator privileges, but can be managed with lower priority than external intrusion paths, he said.

Larin said security updates should be installed immediately as a rule. However, he added that applying every patch quickly is realistically difficult. He went on to say that systems storing critical data need to be isolated through physical network segregation, and that the practical way to prevent damage is to first remediate vulnerabilities at network boundaries exposed to the outside world.

Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242755

References

• https://www.itdaily.kr/news/articleView.html?idxno=242755