Cisco’s Risk-Based Vulnerability Disclosure in the Age of AI

Cisco is evolving its vulnerability disclosure practices in response to AI-driven changes in the cybersecurity landscape. The company is shifting to a risk-based model that prioritizes detailed technical disclosures for high-risk, actively exploited, or critical vulnerabilities. For internally discovered lower-severity issues, Cisco may reduce standalone advisory detail and instead direct customers to security-hardened releases. Practices for third-party and open-source component vulnerabilities remain unchanged for high-severity issues. Cisco is also using AI to accelerate vulnerability discovery and remediation internally, while acknowledging adversaries will leverage the same capabilities.