Rethinking Vulnerability Management: “If It’s Not in the Scanner, It Didn’t Happen” Needs to Go

This blog argues that CVE-centric, scan-first vulnerability management programs are increasingly blind to many vulnerabilities found and fixed internally (notably those discovered by AI models), creating a growing exposure gap; it recommends treating vendor advisories as first-class, machine-readable inputs, having scanner vendors ingest advisories (even without CVEs), and measuring 'currency' (percent of assets on the latest security release) so organizations patch releases rather than rely solely on CVE closure.