Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Patching topic
No spam. Unsubscribe anytime.
Experts: AI speeds patch creation, but legacy systems, downtime and staffing slow fixes
Summary
Witnesses told the committee that while AI can generate patches and detect vulnerabilities quickly, deploying fixes in legacy and operational technology environments often requires downtime or physical intervention; firms advocated virtual patching and state support to accelerate remediation.
Experts told legislators that AI is already speeding vulnerability discovery and making automated patch generation realistic, but real-world constraints keep remediation timelines long.
"Finding vulnerabilities is no longer the hard part, but fixing them fast enough is," Kyla Grew said, summarizing the industry's dilemma: AI can discover and even draft fixes quickly, but legacy infrastructure, required downtime and operational complexity delay deployment. The panel pointed to recent attacks against water systems as an example of how poor hygiene and exposed control systems make remediation urgent.
Thomas McClellan (Palo Alto Networks) described virtual patching—blocking exploit attempts at the firewall or ingress point—as a practical mitigation when immediate code fixes are impractical. "Virtual patching actually is inside the firewalls... we're not actually remediating the vulnerability, but we can identify when an inbound attack is going after that particular exploit and be able to stop it at the firewall level," McClellan said. Panelists urged state investment in representative evaluations, better incentives for patch deployment, and funding to support small local entities' resilience efforts.
