In 2025, a record 48,185 new vulnerabilities were published. The attack surface keeps expanding: more applications, more APIs, more cloud, more exposed systems than most organisations can track.
The volume is not the hard part anymore. Knowing what actually matters is.
Finding vulnerabilities is easy.
Knowing which ones matter is not.
Most security tools are good at producing findings. They are far less good at telling you which findings will hurt you.
Scoring models help, but only to a point. A single vulnerability can carry a high CVSS score, a low EPSS score and an SSVC rating of “Act” all at once. Rely on any one of them in isolation and you will either chase noise or miss the issue that ends up in a breach.
Not all vulnerabilities are created equal. The job is separating the few that matter from the thousands that don’t.
Automation gets you most of the way.
It does not get you all the way.
Automation is essential. No human team can scan millions of assets, watch an attack surface around the clock, or keep pace with tens of thousands of new CVEs a year.
But automation produces probability, not certainty. It flags what might be exploitable. It cannot always tell you whether a finding is real, whether it is reachable in your environment, or what it means for your business.
That gap is where experts earn their place. Validation, context, judgement: these are decisions, not outputs. As I’ve always said, visibility is paramount, and visibility you can’t trust is not visibility at all.
The shortage is no longer just about headcount.
The 2025 ISC2 Cybersecurity Workforce Study found that 88% of organizations had experienced at least one significant security consequence linked to a skills gap. And the nature of the problem has shifted. The constraint is no longer simply a shortage of people. It is a shortage of the right skills, with AI now the most in-demand capability of all. Cyber Security experts will be the auditors and experts in the loop which will require knowledge, skill and experience to rapidly make sure autonomous systems are operating as expected.
“You cannot automate your way out of that. Skilled people are what turn data into decisions, and decisions into reduced risk.”
Why competitions like WICC matter.
This is why Edgescan is proud to support the Women’s International Cybersecurity Challenge 2026 in Dublin this July.
Events like WICC build what classrooms and certifications can’t on their own: working under pressure, thinking critically, making the right call when the data is incomplete. They give talented people real experience, and they widen the pool we all draw from.
The future of cybersecurity is not technology or people. It is both working together. AI will keep changing how security teams operate. It will not replace the judgement that decides what to do next.
If we want a more secure digital world, we must invest in the people who will defend it.
See how Edgescan combines intelligent automation with expert human validation to deliver more effective security testing.
