A critical examination of the implications of using AI to convert CVEs into business risks raises questions about surveillance and control in cybersecurity.