Your n8n and GitLab numbers reframe what a maturity metric should even reward. 67 and 58 percent repeat-disclosure rates mean most programs are measuring ticket-closing velocity, not root-cause coverage, and Gecko's 569-to-105 ratio shows how much of that velocity is wasted motion.
There's a fresh data point that predicts which programs actually clear the bar you're describing. One vendor's AI surfaced over 14,000 previously unknown vulnerabilities in a two-month scan, and across a major disclosure program only about 6 percent of AI-discovered flaws were ever patched. That's discovery scaling without a root-cause architecture behind it: unknown risk converted into documented, unaddressed risk rather than eliminated. Cal.com's two-person team clearing 100 PRs/day only works because they routed to root cause first; most programs bolting AI-driven discovery onto instance-by-instance triage will just grow the backlog faster.
Automated remediation works because it shifts the focus from chasing every individual alert to hardening the underlying architecture. When we stop treating vulnerabilities as isolated bugs and start viewing them as systemic failures of design, the volume of noise drops significantly. True progress happens when we move past the obsession with patch cadence and prioritize the removal of entire classes of flaws through better defaults. My own observations on how operators ignore specific CVEs in favor of broader environmental security confirm that we are finally entering an era where surgical precision beats brute force patching. We are moving toward a state where the infrastructure itself defends against exploitation by design.
The root cause math here only holds if the codebase converges on shared implementations you can point a fix at. That was true of n8n and GitLab's five years of human written history. It gets a lot shakier once 100 PRs a day come out of agents that don't reuse the same auth helper twice, you can end up with the same vulnerability class expressed five different ways with no common commit to trace back to. I saw a version of this at What Breaks recently with MLflow, the patch closed the specific reported path but left the exploit's underlying pattern sitting right next to it, still working five years later. The diligence question for a vendor selling root cause elimination is whether they catch a class showing up as independently written variations, not just literal duplicates and backports.
"an idea that CISA has been advocating for years through Secure-by-Design, which urges software producers to “eliminate common vulnerability classes and publish roadmaps for the rest.”
DUH. As I've been saying for at least twenty years.
AI-assisted design (by AI other than LLMs which are unreliable and insecure by definition) and deterministic-AI-generated code has always been the solution the industry will never do because it "offends" nerd programmers who think they're the cat's meow, despite being as unreliable and insecure as LLMs - as the LLM vulnerability discoveries are now proving.
Your n8n and GitLab numbers reframe what a maturity metric should even reward. 67 and 58 percent repeat-disclosure rates mean most programs are measuring ticket-closing velocity, not root-cause coverage, and Gecko's 569-to-105 ratio shows how much of that velocity is wasted motion.
There's a fresh data point that predicts which programs actually clear the bar you're describing. One vendor's AI surfaced over 14,000 previously unknown vulnerabilities in a two-month scan, and across a major disclosure program only about 6 percent of AI-discovered flaws were ever patched. That's discovery scaling without a root-cause architecture behind it: unknown risk converted into documented, unaddressed risk rather than eliminated. Cal.com's two-person team clearing 100 PRs/day only works because they routed to root cause first; most programs bolting AI-driven discovery onto instance-by-instance triage will just grow the backlog faster.
Automated remediation works because it shifts the focus from chasing every individual alert to hardening the underlying architecture. When we stop treating vulnerabilities as isolated bugs and start viewing them as systemic failures of design, the volume of noise drops significantly. True progress happens when we move past the obsession with patch cadence and prioritize the removal of entire classes of flaws through better defaults. My own observations on how operators ignore specific CVEs in favor of broader environmental security confirm that we are finally entering an era where surgical precision beats brute force patching. We are moving toward a state where the infrastructure itself defends against exploitation by design.
https://cyrilsimonnet.substack.com/p/three-critical-cves-were-available?utm_source=substor&utm_medium=substack&utm_campaign=comment
The root cause math here only holds if the codebase converges on shared implementations you can point a fix at. That was true of n8n and GitLab's five years of human written history. It gets a lot shakier once 100 PRs a day come out of agents that don't reuse the same auth helper twice, you can end up with the same vulnerability class expressed five different ways with no common commit to trace back to. I saw a version of this at What Breaks recently with MLflow, the patch closed the specific reported path but left the exploit's underlying pattern sitting right next to it, still working five years later. The diligence question for a vendor selling root cause elimination is whether they catch a class showing up as independently written variations, not just literal duplicates and backports.
"an idea that CISA has been advocating for years through Secure-by-Design, which urges software producers to “eliminate common vulnerability classes and publish roadmaps for the rest.”
DUH. As I've been saying for at least twenty years.
AI-assisted design (by AI other than LLMs which are unreliable and insecure by definition) and deterministic-AI-generated code has always been the solution the industry will never do because it "offends" nerd programmers who think they're the cat's meow, despite being as unreliable and insecure as LLMs - as the LLM vulnerability discoveries are now proving.