IBM Japan Outlines Vulnerability Management for the AI Era

At Impress AI Days 2026, held September 15–16, IBM Japan’s Tetsuya Kono said advances in frontier AI are shortening the time from vulnerability discovery to exploitation. He said companies need to manage vulnerabilities across both development and production, because the number of vulnerabilities is growing and discovered flaws are being exploited quickly. The event was hosted by Impress.

Japan’s Financial Services Agency called for short-term action by financial institutions in May 2026 in response to threats from frontier AI. Citing the growing speed and scale of attacks, it urged executive-led efforts to strengthen asset management, vulnerability management and monitoring, on the assumption that large numbers of vulnerabilities and patches would arise. Newly registered CVEs (common vulnerability identifiers) rose from about 6,400 in 2016; Kono estimates there will be about 59,000 in 2026, an increase of more than 700%. The upward trend began before frontier AI emerged, and AI technology is also accelerating vulnerability discovery.

Kono’s forecast for time to exploit (TTE), the interval between vulnerability disclosure and exploitation, shortens from “one year” through around 2021 to “one month” in 2025, “one week” to “one day” in 2026, “one hour” in 2027 and “one minute” in 2028. He also cited a figure showing that some vulnerabilities are already exploited in an average of 29 minutes. Because addressing every vulnerability is impractical, he said organizations should prioritize by business impact and exploitation risk and respond quickly.

Kono’s management model combines “Shift Right,” which continuously monitors production risks and applies patches, with “Shift Left,” which reduces risks during development. As AI-generated code becomes more widespread, reviews are struggling to keep pace, increasing the risk that vulnerabilities enter software. Kono said teams also spend time manually organizing information in spreadsheets, struggle to decide priorities and cannot see response status across separate systems in real time across the organization.

IBM Japan’s IBM Concert product line is designed to protect the full software development life cycle (SDLC). Its core product, IBM Concert Protect, gathers vulnerability findings from scanning tools, identifies their impact, calculates risk and prioritizes remediation. For Shift Right, it can draw on existing tools including Prisma Cloud from Palo Alto Networks, the open-source vulnerability scanner Trivy, the Qualys vulnerability management service and Amazon Inspector from AWS. It combines findings from virtual machines, container images and source code with system context—such as whether a system is in production or testing, whether it is publicly exposed and how it connects to other systems—to set priorities.

At Impress AI Days 2026, held September 15–16, IBM Japan’s Tetsuya Kono said advances in frontier AI are shortening the time from vulnerability discovery to exploitation. He said companies need to manage vulnerabilities across both development and production, because the number of vulnerabilities is growing and discovered flaws are being exploited quickly. The event was hosted by Impress.

Japan’s Financial Services Agency called for short-term action by financial institutions in May 2026 in response to threats from frontier AI. Citing the growing speed and scale of attacks, it urged executive-led efforts to strengthen asset management, vulnerability management and monitoring, on the assumption that large numbers of vulnerabilities and patches would arise. Newly registered CVEs (common vulnerability identifiers) rose from about 6,400 in 2016; Kono estimates there will be about 59,000 in 2026, an increase of more than 700%. The upward trend began before frontier AI emerged, and AI technology is also accelerating vulnerability discovery.

Kono’s forecast for time to exploit (TTE), the interval between vulnerability disclosure and exploitation, shortens from “one year” through around 2021 to “one month” in 2025, “one week” to “one day” in 2026, “one hour” in 2027 and “one minute” in 2028. He also cited a figure showing that some vulnerabilities are already exploited in an average of 29 minutes. Because addressing every vulnerability is impractical, he said organizations should prioritize by business impact and exploitation risk and respond quickly.

Kono’s management model combines “Shift Right,” which continuously monitors production risks and applies patches, with “Shift Left,” which reduces risks during development. As AI-generated code becomes more widespread, reviews are struggling to keep pace, increasing the risk that vulnerabilities enter software. Kono said teams also spend time manually organizing information in spreadsheets, struggle to decide priorities and cannot see response status across separate systems in real time across the organization.

IBM Japan’s IBM Concert product line is designed to protect the full software development life cycle (SDLC). Its core product, IBM Concert Protect, gathers vulnerability findings from scanning tools, identifies their impact, calculates risk and prioritizes remediation. For Shift Right, it can draw on existing tools including Prisma Cloud from Palo Alto Networks, the open-source vulnerability scanner Trivy, the Qualys vulnerability management service and Amazon Inspector from AWS. It combines findings from virtual machines, container images and source code with system context—such as whether a system is in production or testing, whether it is publicly exposed and how it connects to other systems—to set priorities.