Every feature you ship is a recurring security bill
Łukasz Wróbel · Every feature you ship is a recurring security bill. AI just shortened the billing cycle.
Like many people in IT, I’ve recently spent a lot of time making sure that the systems I’m responsible for are patched against the latest critical vulnerabilities. It’s not the first time this has happened, but the frequency, severity, and uncertainty are at a level I haven’t faced before.
Google’s Threat Intelligence Group found that AI is “measurably changing” how quickly vulnerabilities are discovered and exploited. The number of vulnerabilities exploited in the wild rose from an average of 10.5 vulnerabilities per month in 2025 to 18 per month in January–August 2026. Zero-days rose only slightly. Most of the growth came from flaws that already had a patch, and Google thinks attackers may be using AI to turn published patches into exploits faster.
How much of the resulting security bill falls to you was decided years ago. It depends on the amount of technical debt hiding in your system. I put together a list of patch-readiness levels for components. You can use it to evaluate your system:
- Level 1: Patched within minutes
Built and maintained according to best practices. The most it takes is a configuration change and an automated test run. - Level 2: Patched within hours
There are dependencies that have fallen behind major API and library releases. Breaking changes need to be handled. Tooling isn’t quite there, and verification isn’t fully automated. - Level 3: Patched within days or weeks
Patching requires major changes, including rearchitecting the application. The component has missed many major releases. Rebuilding all of the original functionality may no longer be possible.
You can minimize the security bill in different ways. Engineering should work on keeping components at a high readiness level and pinpoint which features sit on Level 3 components. Product can use this information to fund a rebuild, limit the scope, or cut the features entirely.
Think about your situation. Who decides whether a Level 3 component gets rebuilt or removed: engineering, product, or the next incident?
