Chris Hughes: Not Prevention, But Resiliency

In the inaugural episode of In Progress, Aviatrix CEO Doug Merritt talks with Chris Hughes — CISA Cyber Innovation Fellow, author of Software Transparency, Effective Vulnerability Management, and Securing AI Agents, and founder of Resilient Cyber — about the forces reshaping security: exponential CVE growth, AI as both attacker and defender, the limits of "human in the loop," and why resilience now matters more than prevention.

Key Takeaways:

• CVEs are exploding — over 40,000 in 2025, with 2026 projections near 60,000 (some estimates up to 100,000) — while AI makes vulnerabilities easier to find and exploit.
• Patching capacity has long lagged below 10% of the backlog; broken production risk and competing business priorities keep it there.
• Security should shift from trying to prevent every incident to containing and recovering from the ones that happen.
• "Human in the loop" doesn't scale against AI-driven attack volume — defenders need to fight AI with AI.
• Security teams that act as collaborators, not blockers, avoid the shadow-IT workarounds that punitive policies create.