Microsoft’s July patch list shows 1,328 vulnerabilities.
Only 627 are actually Microsoft’s. The rest is padding.
And your security scanner runs the exact same play.
My take: AI made finding vulnerabilities cheap, so “we find more” is now the weakest pitch in security. What matters is how much verified risk a tool removes, not how red it can turn a dashboard.
Finding a bug used to be the hard, expensive part. It has quietly become the easiest part of the job.
The work now starts after discovery. Most vendors are still charging you for the discovery.
Where the 1,328 actually comes from
Microsoft’s official July Security Update Guide lists 1,328 vulnerability records. That total gets quoted as a record-breaking month.
Only 627 are Microsoft’s own CVEs. The other 701 are republished third-party entries. 428 of those are Chromium alone.
That gap is the point. The headline number is padded before anyone counts a single new Microsoft bug.
Even the 627 is a pipeline number, not a danger number. Microsoft has warned customers to expect higher volumes as AI-assisted discovery scales, and its own candidates pass through several models, a proving stage, and human review before an engineer ever sees them.
Linux tells the same story from the other side. On July 19 its CVE archive published 431 notices in a single day: leaks, races, bounds checks, error paths.
Linux did not become 431 vulnerabilities less safe overnight. A disclosure pipeline produced 431 records. The count measures the pipeline, not the risk.
How a scanner “finds more”
I sold these tools for years. Every demo peaked at the same staged moment: the scan finishes, the dashboard fills with red, and the rep shows it found more than the tool already in your account.
That comparison used to mean something, because finding capacity was expensive. More coverage plausibly meant a better shot at the bug that mattered.
But a tool can win that count without finding anything real. It lowers a severity threshold, reports one issue three ways, or promotes a weak signal into a finding.
AI removes the last limit. A model keeps searching long after a human would stop, so another candidate is always one prompt away. The dashboard can always get redder. That is not the same as safer.
Ask for these five numbers instead
So when a vendor leads with finding count, stop asking how many. Ask for five different numbers.
1. Validation rate. What percentage of findings survive the vendor’s own attempt to disprove them before they reach a developer?
2. Exploit evidence. How many findings include a reproducible path from attacker-controlled input to meaningful impact?
3. Time to triage. How long does it take to move from “the model thinks” to a decision an engineer can act on?
4. Fix acceptance. How many proposed remediations are accepted, merged, and shipped without creating a regression?
5. Risk removed per engineer-hour. After validation, prioritization, and remediation, how much verified exposure did the tool help eliminate?
The first four are measurable. The fifth forces the vendor to connect its product to the customer’s actual constraint: engineering time.
I already use the same principle in my AppSec metrics guide . Total findings are useful for capacity planning. They are dangerous as a success metric.
Try this before your next renewal
A finding does not become valuable when a model prints “RCE.” It becomes valuable when someone reproduces it, confirms the impact, and ships a fix. Everything before that is inventory.
So open your last scanner report and find the headline “we found X issues” number. Then ask your vendor two things: how many of those X were validated, and how many got fixed.
If they can answer, keep them. If they cannot, they sold you a dashboard, not security.
What number does your AppSec vendor lead with — and can they back it with fixes? Tell me in the comments. I will feature the sharpest answers next week.
Sources
- Microsoft — July 2026 Security Update Guide and Evolving Windows vulnerability management to meet the speed of AI-powered discovery
- Linux kernel CVE team — linux-cve-announce archive
AppSec Santa Weekly — vendor-side mechanics, explained for the people buying and operating the tools. Browse all tools or subscribe for weekly updates.