Vulnerability discovery is starting to outrun the human capacity to fix, and Zscaler says that gap should change how Zero Trust programs prioritize risk.

In an August 13, 2026 blog post, Zscaler’s Anand Singh recapped a Black Hat panel featuring leaders from the Cloud Security Alliance, Qualys, and Rubrik. The starting point was Project Glasswing, Anthropic’s controlled-access program for its Claude Mythos model. Singh writes that in its initial phase, roughly 50 participating organizations reportedly identified more than 10,000 high- or critical-severity vulnerabilities.

Singh’s argument: when AI finds flaws faster than teams can remediate, chasing every CVE by severity stops working. A vulnerability only matters in the context of what it can reach, he writes, so the metric to manage is time to risk reduction, not time to patch. Patching faster is still necessary, but breaking the attack path is the objective.

For security leaders, the practical shift is from raw CVSS queues to exploitability and reachability. What a flaw can actually touch, given your segmentation, becomes the ranking input. That maps directly onto Zero Trust work: microsegmentation boundaries, asset prioritization, and continuous-monitoring dashboards built for auditors rather than backlog counts.