The safe-fix gap: a model of security remediation when AI makes finding cheap and someone else is chasing the same flaws

Uncalibrated working paper. It sets out a model and its notation, with no data. AI has made finding software flaws much cheaper. It hasn't made fixing them safely any cheaper, so the constraint in security has moved from finding to safe change. This paper adds two things. The first is that in security the constraint has an adversary. Attackers share the step AI just made fast, finding the flaw, but carry none of the defender's safety work, so equal access to AI can still favour the attacker. The second is a small model of that situation, the safe-fix gap. A safe-fix rate, S, is change capacity minus the cost of trusting findings, multiplied by the share of fixes that hold. A gap, G, is real-risk arrivals minus S. A risk term, R, weights exposure by how long a flaw stays open, measured from the moment its fix becomes public rather than from the CVE, with danger rising as a flaw ages, plus the risk the fixes themselves create. Trust appears three times, as the cost of trusting a finding, the chance a fix holds and the chance it breaks something. The model also includes an automated lane for low-risk fixes. The paper defines every variable, sets out what the model implies for the asymmetry between attackers and defenders, maps four banded practitioner questions onto its terms, credits prior work and states where the model overclaims. Disclosure. The author works at Axonius, a cybersecurity company. This paper is written in a personal capacity, makes no product claims, and its views are the author's own.