New vulnerabilities are discovered in code faster than developers can fix them.
Even daily reprioritization cannot keep up with hourly code changes. Reachability changes with every code changes and reachability detection tools cannot keep up.
Cornell University researchers proved that GPT4 can now generate exploits for 87% of vulnerabilities given its CVE description. Source
If an attacker can load and execute vulnerable code, it does not matter that a developer did not call that function. It’s reachable! Whole groups of malware use this technique to breach organizations.
3/4th of open-source critical and high vulnerabilities are unfixed. A developer can’t fix them, VM tools ignore them and DevSecOp teams give them a pass.
