Act Security's Ambitious Claims Offer a Patchless Solution to New CVEs

Emerging from stealth mode with a hefty funding bag of $60 million, Act Security — a cybersecurity firm that surfaced from Tel Aviv — claims to tackle a monumental problem: the patching inefficiency exacerbated by growing AI technologies in cloud environments. Their approach involves reducing access sprawl rather than directly patching vulnerabilities, which raises immediate skepticism. In a world projected to see an influx of around 59,000 new Common Vulnerabilities and Exposures (CVEs) in 2026, one might question whether such a strategy is anything more than a stop-gap measure.

The Peril of Growing Vulnerabilities

The alarming forecast from the Forum of Incident Response and Security Teams (FIRST) paints a vivid picture of the future threat landscape. With approximately 161 new vulnerabilities cropping up daily, no amount of funding can mask the uncomfortable truth: the sheer volume of risks outweighs the mitigative measures currently in place. Major vendors like Oracle and Microsoft are certainly making strides, having patched over 1,400 and 622 vulnerabilities, respectively, in their recent updates. Yet the fundamental issue remains: the faster vulnerabilities arrive, the greater the challenge for organizations, many of which are already operating well beyond their capacity to manage existing risks. Amid such chaos, a promise of simplifying the access sprawl sounds deceptively appealing.

Act Security's Focus: A Band-Aid on a Gaping Wound?

Act Security intends to reduce attack surfaces, focusing on unnecessary permissions that can put entire organizations at risk. This is a strategy harkening back to age-old advice: least privilege access is a quintessential best practice. However, the efficacy of such an approach is questionable in an environment increasingly dominated by AI-driven vulnerability discovery. By sidestepping direct interventions in the patching process, Act Security might inadvertently suggest that merely reducing access can override the need for ongoing updates and robust cyber hygiene. A notable concern remains: does solving the symptoms genuinely address the disease? Or is this yet another vendor sidestepping the complexity of rapid advancements in cyber threats?

Buzzwords and Bandwidth: A Cautionary Tale

It’s crucial to dissect how Act Security's mission is framed within the broader narrative of cybersecurity. As organizations scramble to cope with increasing vulnerabilities, any service promising relief deserves scrutiny. Consequently, the language surrounding their launch, emphasizing 'reducing access sprawl,' could easily be perceived as buzzworthy jargon rather than actionable intelligence. In this fast-evolving field, where rapid innovation is a double-edged sword, we can't afford to be lulled into a sense of security by sound bites and slogans. The question is whether Act Security's proposed solutions can withstand the scrutiny of actual performance in the heat of a vulnerability onslaught.

The Missing Link: Verification and Validation

A venture like Act Security, which aims to rebuild the foundations of cloud security amid a patch crisis, must recognize the high burden of verification and validation resting on its shoulders. While addressing the sprawling permissions in cloud infrastructures may provide some respite against exploitation, it doesn’t eliminate the need for companies to manage and patch identified vulnerabilities efficiently. The cloud environment is a dynamic battlefield, littered with both old and emerging threats requiring a multi-layered defense. Merely setting up controls to limit access won’t sufficiently counteract the onslaught of fresh vulnerabilities that can crop up in minutes.

Conclusion: The Reality Check

While Act Security’s bold claims about patchless solutions are forthright, skepticism remains warranted. The looming challenge of a projected flood of new CVEs is not a problem that can simply be shelved. As long as the cybersecurity community fails to keep pace with this relentless tide, solutions like those proposed by Act Security will be viewed, at best, as palliative measures — not as a fix to an underlying systemic failure. If the patch problem is real but the discourse signals an over-optimism ungrounded in accountability, then we must keep our focus sharp and demand more than just promises from cybersecurity startups.

Disclaimer: This article is written from the perspective of an AI cybersecurity columnist and reflects a skeptical viewpoint on cybersecurity claims.

Sources: https://www.securityweek.com/act-security-emerges-from-stealth-to-fight-the-patch-problem