A top Microsoft security executive called for the industry to prioritize building safer software from the start rather than relying on traditional patch management, arguing that AI is fundamentally shifting the economics of cyberattacks in favor of malicious actors.
David Weston, corporate vice president for AI security at Microsoft, told attendees at Black Hat USA that AI enables attackers to discover and weaponize software vulnerabilities faster than ever. The most efficient way to counter this, he said, is to proactively build safer software.
"What we want to do is retrain the physics here," Weston said. "We want to figure out where we can use this production advantage to actually turn the tables."
Attackers are weaponizing vulnerabilities at scale
Weston said that while tens of thousands of vulnerabilities are documented each year, only about 90 are exploited in the wild annually. Most breaches today result from credential theft, phishing, or social engineering - not from novel exploits. However, when vulnerabilities are exploited, they are typically known, unpatched flaws.
That assumption of scarcity "is being undermined as we speak," Weston said. The Microsoft Security Response Center is now processing double the number of vulnerabilities every six weeks compared to previous cycles. The number of CVEs processed per month has increased about ninefold since March, a surge Weston attributed directly to the rising use of AI by attackers.
Internal data confirmed the trend. Microsoft's MDASH code-scanning harness found more than 200 Linux kernel vulnerabilities in its internal Azure Linux distribution. The company added a module that automatically converts static analysis findings into proof-of-concept exploits. Of those 200 vulnerabilities, researchers generated 182 working PoCs, many of which are fully functional exploits. Weston also cited data from the ExploitGym benchmark showing that about 157 working exploits could be generated from 898 real-world vulnerabilities.
Attackers have used AI to automate attacks, including an incident where hackers deployed Anthropic's Claude model to target a Mexican water utility.
"Hand-to-hand combat with attackers will cause us to lose in defense," Weston said during the keynote.
Memory-safe languages and automated remediation
Weston argued that defenders can offset attacker productivity gains through secure-by-construction development, formal verification, and prevention before verification. Roughly 70% of all vulnerabilities stem from memory safety issues, which could be eliminated by using safer programming languages like Rust.
One barrier to adopting such languages has been cost and complexity. Microsoft Research introduced an AI-based project called RustAssistant in 2025, which uses large language models to help find and suggest fixes for Rust compilation errors. Separately, a Defense Advanced Research Projects Agency program called Tractor aims to automatically convert legacy C code into Rust.
Why this matters for IT and development professionals
For developers and IT teams, the key takeaway is that traditional patch cycles are no longer a viable primary defense. The economics of cyberattacks have shifted: AI lets attackers find and weaponize vulnerabilities faster than organizations can patch them. The practical response is to adopt memory-safe languages like Rust and use AI-based tools to automate code conversion and vulnerability detection. Resources like a dedicated AI Learning Path for Software Developers can help teams build these skills into their workflow. For broader context on how AI reshapes development work, the AI for IT & Development category offers ongoing coverage.
Your membership also unlocks:
