AI Reshapes SOC Reporting: EY on Vulnerability Discovery

AI is rapidly changing how vulnerabilities are discovered, reshaping expectations for SOC reporting. Boards and audit committees are now asking how service providers are addressing AI's ability to swiftly detect and exploit weaknesses. Jaime Kipnes, an EY leader, emphasizes that cyber resilience now depends on strong governance, effective controls, and proof that those controls work. Service organizations should expect customer inquiries that go beyond simple due diligence. Customers will want assurance on how vulnerability management programs have adapted to AI-driven threats. This also means more granular procedures and deeper testing from auditors. High-level control descriptions, like "vulnerabilities are tracked," may no longer be enough. One key area of increased scrutiny is vulnerability management. AI-accelerated threats demand moving beyond simple severity-based identification. Organizations need to show how specific vulnerability findings are identified using multiple tools, prioritized quickly, and addressed promptly. This shift impacts how businesses must demonstrate their cyber defenses.