National Life Group CISO expects more vulnerabilities in six months than in thirty years

In this Help Net Security interview, Becky Palmer is VP and CISO at National Life Group, answers five questions about defending against AI-driven attacks. The discussion covers why patch cycles built for human speed cannot keep up, and which compensating controls buy time when an immediate fix is not possible. It includes numbers from agentic AI in the security operations center, where four of five cases close without human escalation.

The rest looks at questions that separate a working AI product from a wrapper, contract terms for third-party AI use, and three steps smaller banks and carriers can take in 90 days.

Time from disclosure to weaponized exploit has compressed because attackers use AI to write the exploit. What did you change in patch and compensating-control practice to keep up, and how did you get the business to accept the new maintenance windows?

The fundamentals of vulnerability management haven’t changed, but the speed and scale of vulnerability discovery and exploitation are changing dramatically. With the introduction of Frontier AI, we are likely to uncover more vulnerabilities in the next six months than we have in the last thirty years. AI helps attackers find and weaponize vulnerabilities at machine speed, reducing the time it takes to attack from weeks to, in some cases, hours.

When attackers operate at machine speed, a patch process that runs at human speed can’t keep up. We’re looking at opportunities to fight AI with AI to automate patch management. We need to use AI to correlate new vulnerabilities against our environment, prioritize by exposure, and drive the test-and-deploy cycle to compress patch cycle time. The benefits of AI will allow us to compress the testing window prior to patching, not bypass it and increase business risk.

The reality is that organizations will always have some vulnerabilities. Many security breaches originate from vulnerabilities that have been known about for years, not just days or weeks. It’s important to patch quickly where possible. When an immediate fix isn’t feasible, we put compensating controls in place to reduce exposure until the underlying vulnerability can be remediated. Compensating controls don’t fix the vulnerability, but they restrict the attacker’s ability to reach it.

A few examples we rely on include_

1. Virtual patching using our web application firewall, intrusion prevention system, and endpoint protection to block the specific exploit traffic.

2. Tightening access by restricting who and what can reach the exposed system and enforcing least privilege and stronger authentication around it.

3. Heightened monitoring, putting targeted detection on the vulnerable asset so we’d see exploitation attempts immediately and respond.

By automating where we can, prioritizing based on real exposure, and layering compensating controls where immediate remediation isn’t possible, we can compress our response time and stay ahead of attackers who are moving faster than ever. The goal isn’t a perfect environment with zero vulnerabilities, that will never exist. We are focused on a disciplined, resilient program that shrinks the window of opportunity for attackers and meets machine-speed threats with machine-speed defense.

Which AI-assisted security capability has reduced analyst workload for you, and what did the before-and-after numbers look like? Which one failed to earn its keep, and why?

We recently started leveraging agentic AI in our SOC and it has been a force multiplier in both quantity and quality for security investigations. AI allows us to automate complex investigations and bridge the gap between detection and human context. For AI-enabled use cases, 4 out of 5 are resolved without human escalation. We see hours of time saved each day in automated searches, context enrichment and advanced summarization, freeing up our team to focus their expertise on risks that require human judgment.

That’s an important distinction in how I think about AI in cybersecurity. The goal isn’t necessarily to replace the analyst; it’s to give analysts the ability to operate faster and focus their time where it has the greatest value.

How do you evaluate a security vendor’s AI claims during procurement? Give me the questions you ask that separate a working product from a wrapper.

There seem to be thousands of new AI security companies popping up these days, some of which will go on to do great things, and some will disappear almost as quickly as they arrive. We need to do our due diligence to determine whether each can deliver value to our organization. Some of the initial questions to ask include:

• Can I run a proof-of-value with my own data to verify the functionality?
• Is it using a protected instance or leveraging any public AI models?
• What can it do autonomously, is every action logged, and what’s the kill switch?
• What’s my total cost for real usage?

It’s not enough for a vendor to tell me what an AI-enabled security product can do. Each of their “intelligent”, “adaptive”, or “autonomous” claims should convert into a measurable test or a contract term. If not, treat it as marketing. I also want to know what can happen when it behaves unexpectedly, is misused or encounters a scenario it wasn’t designed for.

Security leaders should look beyond the AI label to understand what capability the technology is providing and how its performance has been independently validated. Never skip the proof-of-value evaluation with your own data. Ultimately, the question is whether it meaningfully reduces risk or improves the security team’s ability to detect and respond. Simply knowing it leverages AI is not enough.

Vendors and independent agents are now using AI you did not approve on data you are accountable for. What did you add to contracts and to your assessment questionnaire that produced useful answers?

We treat third-party AI use as both a vendor-risk and data-governance issue. Our vendor risk assessment requires vendors and independent agents to disclose the AI tools and models they use, the sensitive data involved, where that data is processed, how long it is retained, and whether it is used for training so we can evaluate the security controls they have in place to protect our sensitive data. Our contracts then establish the guardrails, including prior approval, approved enterprise LLM environments, restrictions on unapproved third-party LLMs, limits on training and secondary use, and controls over AI providers and subcontractors.

Give me the three-item must list for a security leader at a smaller carrier or bank who has no AI budget and needs to reduce AI-driven risk in 90 days.

Three items security leaders at a smaller carrier could prioritize to reduce AI-driven risk in a 90-day period are:

1. Understand and prioritize your highest risks: You don’t need a large AI budget to improve your security posture. As I stated before, no organization can eliminate every vulnerability, so start by understanding where your most sensitive information resides, where you’re most exposed, whether you can detect data leaving, and which risks could have the greatest impact. Focus your resources there rather than trying to address everything at once.

2. Strengthen identity and access management: Make sure employees only have access to the systems and information they need to do their jobs and limit administrative privileges where possible. Strong identity governance can make it significantly more difficult for an attacker (AI or human) to turn a compromised account into a larger incident.

3. Train your employees: First and foremost, your employees need to understand where they can and cannot enter non-public company information into AI tools. This should be communicated in training, and you should document it in your information security policy. Security awareness training should also stress that AI is making phishing and deepfake attempts increasingly convincing. Regular phishing simulations, ongoing cybersecurity training and creating a culture where employees quickly report suspicious activity provides a critical layer of defense.

Download report: How security controls perform in practice