For IT and security leaders at mid-market and multi-site organizations, the most valuable budget request right now is not for AI. It is for a vulnerability management program that finds exposures, fixes them on schedule, and proves they are closed. On October 22, 2026, Jason D. Clinton, deputy CISO at Anthropic, posted on X that security leaders should go to their boards and ask for help right now, not for AI, but for the basics. He added that things will likely get worse before they get better over roughly the next 18 months.
In August 2026 he also warned on X about a coming “vulnerability tsunami”, saying there would not be enough time to patch critical infrastructure and urging network isolation measures such as air-gaps and data diodes. Clinton and Anthropic have no connection to BTI, and we do not speak for them. His warning does line up with what we see: attackers are finding and exploiting weaknesses faster, and organizations with disciplined fundamentals are the ones that hold up.
Not sure where your gaps are? Get a free cybersecurity assessment and see your exposure, patching gaps, and fastest risk reductions.
Vulnerability management with verified closure: the basics cycle
“The basics” is a repeatable operating cycle. Most incidents we review trace back to a gap in one of these steps.
1. Know every asset you own. Keep a current inventory of endpoints, servers, cloud workloads, network devices, SaaS apps, and internet-facing services at each location. Multi-site organizations often turn up unmanaged firewalls, forgotten test servers, or branch equipment nobody tracks.
2. Scan continuously, not annually. Run authenticated scans across internal and external assets on a set schedule and after major changes. A scan once a year before an audit is a snapshot, not a program.
3. Prioritize what attackers actually use. Rank findings by known exploitation, internet exposure, and business importance, not severity score alone. That keeps a small team focused on what matters.
4. Patch and remediate with clear owners. Operating systems, third-party apps, firmware, and network devices need defined patch windows and named owners. When a patch is not possible, document a compensating control such as network isolation, access restrictions, or disabling the vulnerable service.
5. Verify closure. A ticket marked “done” is not proof. Rescan, confirm the finding is gone, and keep the record. Verified closure is what turns patching activity into measurable risk reduction.
6. Monitor around the clock. Some attacks will land before a fix does. Centralized logging, a SIEM, and a staffed SOC let you catch suspicious activity in minutes or hours instead of weeks.
7. Keep audit-ready evidence. Scan results, tickets, exceptions, and closure records are exactly what assessors ask for. As we explain in what auditors expect from vulnerability management with documented closure, they want a working process, not a stack of unresolved reports.
Want this cycle run for you? Explore our managed cybersecurity services for scanning, remediation, verified closure, and 24/7 monitoring.
Secure AI and vibe coding start with vulnerability management
AI is worth pursuing, and we help clients adopt it. But AI tools and AI-built apps add new assets, identities, data flows, and code. If inventory, patching, and monitoring are already behind, each new project widens the gap.
“Vibe coding,” where staff use AI assistants to build internal apps quickly, is a clear example. These apps often ship with exposed secrets, broad permissions, outdated dependencies, or unreviewed public endpoints. Our guide to securing vibe-coded and AI-built apps in Azure covers identity controls, network isolation, secrets management, and scanning before production.
The order matters. With the basics in place, a new AI app is just another asset that gets inventoried, scanned, patched, and monitored. Without them, it is one more thing nobody is watching. That is why we treat AI as governed adoption within our broader secure, governed IT and AI services.
How BTI helps: managed or co-managed vulnerability management and security ops
BTI Communications Group has supported organizations for over 40 years. We deliver the cycle above in the model that fits your team.
Hand off the whole program. Our outsourced IT services with vulnerability management and 24/7 SOC run security end to end.
Add depth to your internal team. If you have capable IT staff who need more hands and specialized skills, our co-managed security and compliance execution adds BTI technicians and security operations alongside your people, with clear ownership of who does what.
Faster triage, human accountability. Our technicians use AI-enabled tools to sort findings, correlate alerts, and draft remediation steps. A named technician owns each remediation, exception, and closure. AI speeds up the work; people sign off on it.
Proof that risk is going down. We scan, prioritize by exploitability and impact, remediate or document compensating controls, then rescan to confirm. Reporting shows open risk trending down, not just activity.
Around-the-clock detection. Our SOC 2 Certified NOC/SOC monitors logs and alerts 24/7 through our SIEM, investigates suspicious activity, and escalates with context so your team is not chasing noise.
Compliance evidence without the scramble. BTI is ISO 27001 compliant, and we build programs with audits in mind, keeping policies, risk registers, scan records, and closure evidence organized. CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
What to bring to your board
If you take Clinton’s advice to your board, a concrete ask lands better than a general warning. Bring:
- Your current asset count and the share covered by authenticated scanning
- Open critical and high findings, and how long they have been open
- Average time from detection to verified closure
- Whether you have 24/7 monitoring, and who responds after hours
- The funding or staffing needed to close those gaps over the next two to four quarters
These numbers show the board where the risk is and what it costs to reduce it. If you do not have them yet, an assessment is the fastest way to get them.
Frequently asked questions
What is vulnerability management with verified closure?
It is a continuous process of inventorying assets, scanning for weaknesses, prioritizing by real risk, remediating, and then rescanning to confirm each fix worked. The verified closure step produces evidence that the risk is gone, not just that a ticket was closed.
Why prioritize vulnerability management before AI projects?
AI projects add new apps, identities, and data flows. Without inventory, patching, and monitoring in place, those additions become unmanaged exposure. Strong vulnerability management means new AI tools are secured like every other asset from day one.
How does co-managed security operations work?
Your internal IT team keeps ownership of the environment while BTI adds technicians, vulnerability management, SOC monitoring, and compliance support. Responsibilities are defined up front, so everyone knows who scans, who patches, who verifies closure, and who responds to alerts.
Get a clear picture before the pressure builds
The next 18 months may be harder for defenders. Getting the basics right now gives you a stronger position with your board, your auditors, and your AI plans.
Get a free cybersecurity assessment
Talk to our cybersecurity team
Related reading
- When Patching Is Not Enough: Rotate Passwords, MFA, and API Keys After Critical Vulnerabilities
- Securing vibe-coded and AI-built apps in Azure
- What IT compliance auditors want to see in vulnerability management
- Managed cybersecurity services
- Co-managed IT security and compliance execution
- Outsourced IT with vulnerability management and 24/7 SOC
- Free cybersecurity assessment
- Secure, governed AI adoption and IT services
- Managed patching, vulnerability management, and vCISO
