From Backlog to Closed: A Practitioner’s Playbook for Enterprise Vulnerability Management and Remediation at Scale

Overview

According to the 2026 Verizon Data Breach Investigations Report, exploitation of vulnerabilities is now the most common initial access vector in confirmed breaches, reaching 31% of incidents (up 55% year over year). Despite this, vulnerability remediation is moving in the wrong direction: only 26% of critical vulnerabilities in the CISA KEV catalog were fully remediated in 2025, down from 38% the year before. The median time to fully close a known, exploited vulnerability has grown by two weeks to 43 days.

Organizations faced 50% more critical vulnerabilities to patch in 2025 than in 2024. With frontier AI cyber models like Open AI Daybreak and Claude Mythos that backlog is about to grow. In this session, Mark Lambert, Chief Product Officer at ArmorCode, shares specific insights from security practitioners.

What you’ll learn:

• How to rethink your backlog as a risk decision, not a queue.
• Why risk-based prioritization grounded in business context, chained vulnerabilities, exploitability, reachability, and attack path analysis is now foundational.
• What vulnerability remediation looks like in practice and where it breaks down.
• From code-level fixes and scanner-generated pull requests for application security, to patch management for infrastructure security the failure modes for remediation are distinct, and so are the operational solutions.
• How to manage exposure with mitigation controls while remediation is in progress. Assessing existing controls, identify gaps, and make defensible residual risk decisions while vulnerability remediation is in progress so your security posture doesn’t depend entirely on patch velocity.

Who should attend:
CISOs, VP/Director-level AppSec and Infrastructure Security leaders, and security engineers responsible for enterprise vulnerability management programs at mid-size and large organizations.

Speaker: Mark Lambert, Chief Product Officer, ArmorCode
Mark leads product strategy at ArmorCode, working directly with enterprise security teams navigating the gap between vulnerability discovery and meaningful risk reduction. He brings a practitioner’s perspective to the hardest operational problems in enterprise vulnerability management and joins us for a deep-dive focused entirely on what vulnerability remediation at scale actually takes.

Part of the ArmorCode Frontier AI Webinar Series
This is the third session in a continuing series on security operations in the age of frontier AI. Previous sessions covered what Claude Mythos changes — and what it doesn’t (May 2026, PBC Virtual) and five steps to operationalizing vulnerability management at AI-scale (June 2026).