Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)? It’s the Economy, Stupid.

The author argues that while AI has driven a several-fold surge in high-severity vulnerabilities, this 'Vulnpocalypse' has not yet produced a corresponding 'Breachpocalypse' because economic constraints—primarily attackers' inability to reliably monetize and launder proceeds—remain the main bottleneck; evidence includes CVE growth, modest increases in SEC-reported material breaches, declining ransomware revenues, and falling initial access broker prices, and the recommendation is to prioritize disrupting cybercrime monetization and adapt defenses for faster, AI-enabled attacks.