Fixing vulnerabilities one by one may do little to reduce the overall volume of software flaws, argues a new essay on software security. Its alternative is to look for ways to eliminate whole families of vulnerabilities, rather than treating each bug as a separate repair job.
Watch Desk analysis
What happened
In “Dense in Depth: Rethinking Security When Vulns Are Everywhere”, a Medium essay published on 5 November, the author argues that vulnerabilities are “dense rather than sparse”. In this account, flaws arise from the many execution paths and program states software can reach, not simply from lines of code. The essay says its argument draws on data from Google Chrome and AI-assisted scanning.
The author’s proposed shift is from finding and fixing individual bugs to building systemic mechanisms that prevent entire classes of flaws. The supplied account does not give the underlying data, measurements or details of those mechanisms, so the argument is best read as a security perspective, not a demonstrated result.
Why it matters
A steady stream of bug fixes can be valuable, but the essay challenges the idea that adding up those fixes necessarily makes a complex programme secure. If the underlying problem comes from how many paths and states the software permits, teams may need to change how systems are designed and constrained, not just get better at finding the next flaw.
That is relevant beyond security teams: AI-assisted scanning is part of the essay’s discussion, but its central question is what scanning can accomplish if the underlying structure keeps producing vulnerabilities. Detection can help find trouble. It is not, by itself, a way to make the trouble stop recurring.
Our read
The argument is a useful prod against counting bugs fixed as the whole security scorecard. But “eliminate entire families” is a destination, not a recipe; readers would need concrete examples and evidence to judge how practical the proposed shift is. The sensible takeaway is to ask what recurring weakness a fix addresses, not only how many tickets it closes.
What to watch
- What Chrome data the essay uses, and how it supports the claim about vulnerability density.
- Whether the author offers concrete examples of mechanisms that prevent classes of flaws.
- How AI-assisted scanning fits into that approach: finding more bugs, or helping prevent them at the source.
Discussion spark: Should software security teams prioritise fixing more individual bugs, or redesigning systems to prevent whole classes of them?
Sources and evidence
- Dense in Depth: Rethinking Security When Vulns Are Everywhere (5 November 2026, 14:15 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.