Rethinking Vulnerability Management: “If It’s Not in the Scanner, It Didn’t Happen” Needs to Go

Many modern vulnerability management (VM) programs rely on scanner-discovered CVEs as the primary trigger for patching, which creates a blind spot when vendors privately fix issues (including AI-discovered fixes) without assigning CVEs. The author warns this gap contributes to a growing systemic risk—'the vulnerability apocalypse'—because scanners miss internally fixed, potentially exploited bugs; recommends treating vendor advisories as first-class inputs (machine-readable advisories, scanner ingestion of non-CVE fixes, and a 'currency' metric), and proposes operational changes to patch releases rather than waiting for CVE-driven findings.