Barracuda Networks Models How AI Will Shift Vulnerability Discovery Toward Attackers Over Next Five Years

Barracuda Networks has published new modelling that projects how AI-driven vulnerability discovery will reshape the cybersecurity landscape, warning that attackers are likely to find the majority of software flaws before defenders within five years.

The analysis builds on Anthropic’s Mythos research from April 2026, which demonstrated that AI models can identify software vulnerabilities and generate working exploits faster than human researchers. State-sponsored groups are already using these capabilities, and as AI models improve, access to them will widen across the threat landscape.

Modelling what Mythos means for CVE volumes

Barracuda’s analysis is framed around a question that has not been publicly modelled until now: what does AI-assisted vulnerability discovery mean for the Common Vulnerabilities and Exposures (CVE) landscape over time?

The company built a five-year model spanning four scenarios, varying large language model capability between 60 and 80 per cent and the share of the existing vulnerability backlog discovered each year between 10 and 30 per cent.

Even the most conservative scenario projects a surge in published CVEs in the first year, as AI rapidly surfaces the large volume of flaws already present in deployed software.

Attackers set to discover the majority of flaws

The most significant finding from the modelling is not about volume. It is about who finds the vulnerabilities first.

Across all four scenarios, the attacker share of CVE discovery rises from roughly one in three today to between 55 and 72 per cent by year five.

That means defenders will increasingly be responding to vulnerabilities that attackers already know about and may already be exploiting. The strategic problem shifts from discovering flaws faster to remediating them faster.

Arve Kjoelen, Chief Information Security Officer at Barracuda Networks, framed the shift in terms of economics.

“AI changes the economics of vulnerability discovery. Large language models can surface flaws at a pace and scale that removes discovery as the primary constraint,” Kjoelen explained.

“In an AI-accelerated landscape, security outcomes depend less on finding vulnerabilities first and more on how quickly organisations can assess, prioritise and patch exposed systems.”

Remediation speed becomes the critical metric

Barracuda argues that security teams need to treat remediation capability as a priority, rather than continuing to focus primarily on detection and discovery.

The company’s recommendations include increasing the frequency of vulnerability scanning and automating patching with a focus on the most critical exposures first. It also advocates reducing attack surface by using zero-trust network access to eliminate direct public access to servers.

Deploying web application firewalls in front of external-facing web servers, tightening network segmentation rules on existing firewalls and ensuring controls apply consistently across all users and endpoints are also among the measures Barracuda outlined.

The company also recommended that organisations verify their ability to detect and respond to incidents effectively by reviewing security playbooks, running simulation exercises and validating backup and recovery capabilities.

AI is already being used beyond vulnerability exploitation

The modelling focuses on vulnerability discovery, but Barracuda noted that attackers are already using AI to improve phishing campaigns and automate credential-based attacks.

The company urged organisations to strengthen identity and email security, implement phishing-resistant multifactor authentication (MFA) and audit MFA coverage across all users.

Interactive model published for scrutiny

To support ongoing debate, Barracuda has published the underlying model and its assumptions as an interactive tool at ai-hype.ai, allowing security professionals to explore the scenarios, challenge the inputs and track how AI-driven vulnerability discovery may evolve.

The company indicated this is an ongoing area of research, with further posts planned covering updates to the model, real-world signals from CVE data and deeper analysis of what the projected shifts mean for security leaders.

Last Updated on May 11, 2026 by Nick Ross