Gartner analyst Craig Lawson believes 2026's surge in security patches, driven partly by AI bug-hunting tools such as Anthropic's Mythos, could lead to a marked easing of workloads for security teams in 2027. Speaking at Gartner's IT Symposium in Australia, he argued that this year's unusually high volume of vulnerabilities being uncovered, including in traditionally secure systems like OpenBSD, reflects AI systematically clearing out long-standing technical debt in established codebases rather than software becoming less secure. Because vendors are increasingly using the same AI tools to test their own products before release, he expects fewer severe flaws to emerge next year even if raw vulnerability counts stay high.

Lawson cited Microsoft's recent release of over 970 patches as the kind of event that looks alarming but may actually signal a one-off clean-up rather than a permanent trend. He predicted 2027 could be the first year with a net drop in flaw severity, and suggested AI could let organisations run red-team-style exercises daily instead of relying on costly, infrequent external assessments. He also floated AI assisting analysts with rapid fixes, such as drafting virtual patches, and urged security operations centres to shift their focus from ticket-closure metrics to recognising the real-world impact of defenders' work, such as preventing ransomware attacks.