AI is accelerating vulnerability discovery—here’s how Cohesity is responding

Recent reporting on next-generation AI models, including Anthropic’s Claude Mythos and OpenAI’s GPT 5.4-Cyber, raises questions about how advances in AI may impact software security.

This post outlines how Cohesity approaches product security, and how we are preparing for continued advances in AI.

Our approach to product security

Cohesity operates a rigorous product security program aligned with industry best practices designed to identify, prioritize, and remediate vulnerabilities across our software footprint.

This includes:

• Secure-by-design development practices
• Automated and expert-led testing, including SAST, DAST, and software composition analysis (SCA)
• Continuous analysis of third-party dependencies, including open-source components
• Ongoing penetration testing and product hardening

When vulnerabilities are identified in these components, we assess impact, track upstream fixes, and incorporate updated versions or mitigations as part of our remediation process.

We use a range of available tools, including frontier AI models, to support this work, particularly in vulnerability analysis, exploitability assessment, and remediation planning. No customer data is sent to external models. We constantly work to access and apply state-of-the-art capabilities in these areas. Cohesity presently has access to some non-publicly available AI systems and uses them as part of our product security framework.

To learn more about our process, consult the Cohesity Trust Center.

How we manage vulnerabilities

When vulnerabilities are identified, through internal testing or external reporting, we follow a structured process:

• Assess severity and exploitability.
• Prioritize remediation based on risk.
• Develop and validate fixes.
• Deliver patches and mitigations through established release channels.
• Communicate clearly with customers through advisories and support channels.

This process applies consistently across Cohesity-developed code and third-party dependencies. For external components, remediation involves upgrading to fixed versions or applying mitigations where appropriate.

Operating at speed

As the pace of vulnerability discovery increases, the speed of remediation becomes a critical factor in reducing risk.

Cohesity’s security processes are designed to operate at pace. We prioritize vulnerabilities based on severity and exploitability and deliver fixes through established release mechanisms, including accelerated updates when warranted. 

We are preparing for the potential of increased vulnerability discovery across our products and infrastructure. This includes scaling our internal processes, tooling, and response coordination to maintain high standards of responsiveness and transparency if volumes increase.

Cohesity already applies AI-assisted techniques in vulnerability analysis and remediation workflows today and will continue to incorporate new capabilities that improve speed, accuracy, and scale.

We work to make patching as streamlined and nondisruptive as possible for customers. This includes improving delivery mechanisms, minimizing operational impact, and providing clear guidance to support rapid adoption.

What customers should expect

Customers should expect:

• Consistent application of secure development and vulnerability management practices.
• Timely security advisories and clear guidance when issues affect Cohesity products.
• Transparent communication to support risk-based decision making.

For exploitable critical severity vulnerabilities, Cohesity will continue to provide security advisories, mitigation guidance, and patches through our support channels.

Customer actions to take

To reduce exposure, customers should apply patches promptly, particularly for critical systems. We acknowledge that customers make their own risk assessments about whether and when to apply patches. We will continue to be transparent about the severity and details of vulnerabilities to enable customers to make accurate risk decisions. For customers who prioritize rapid patching, Cohesity offers cloud-based deployment options that manage patching and apply updates as they become available.

At the same time, organizations should not rely solely on patching. Defense-in-depth strategies, including network segmentation, least-privilege access, and hardened configurations, remain essential to reducing exploitability, especially as vulnerability discovery accelerates. Cohesity provides product hardening and deployment guidance. We encourage customers to regularly review this guidance and implement elements based on their risk tolerance.

Our commitment as your resilience partner

Even with strong security practices, no system is immune to incidents.

Our platform is designed to help customers quickly and reliably recover data and operations in the event of a cyber incident. We are committed to supporting our customers before, during, and after an event.

As a trusted supplier, we are also taking proactive steps to further harden our environment, monitor for vulnerabilities, and increase our capability to manage their risk as part of our security program.

Looking ahead

We continue to monitor developments in this space and evaluate new capabilities as they become available.

Our focus remains consistent: delivering secure products, responding quickly to vulnerabilities, and helping customers reduce risk in an evolving threat environment.

We will update this post as additional information becomes available.