Uploaded May 2026 | Updated September 2026, 5 hours ago
Yotam Perkal (Pluto Security, IL)
AI is rapidly reshaping vulnerability management, and the upcoming years will determine whether defenders or attackers are gaining the upper hand. On the defensive side, AI promises meaningful progress: improved prioritization in the face of exponential vulnerability growth, better signal extraction from increasingly noisy data, faster identification of vulnerable components, and earlier insight into real-world exposure. As the rate of vulnerability disclosure continues to outpace remediation capacity, these capabilities are becoming essential to keeping VM programs viable. At the same time, AI is actively increasing pressure across the vulnerability ecosystem. Automated, low-effort vulnerability submissions (“AI slop”) are placing growing burdens on triagers, CNAs, and open-source maintainers. The technical barrier for effective exploitation is rapidly dropping, shortening the time from vulnerability discovery to weaponization and enabling more adaptive, personalized attacks at scale. Recent research and real-world incidents demonstrate that AI-powered attacks have moved from theory to practice, spanning nearly the entire MITRE ATT&CK lifecycle. This talk examines the AI arms race through a vulnerability management lens, highlighting both its defensive potential and its destabilizing effects. We explore where current workflows begin to fail when confronted with AI-driven discovery and exploitation, and what must change as a result. Rather than incremental optimization, defenders need to revisit foundational choices, from prioritization and disclosure to automation boundaries and system design, to remain effective in an environment shaped by autonomous, adaptive adversaries.
---
Yotam Perkal leads security research at Pluto Security, a next-generation AI security and governance platform designed to protect the rapidly emerging ecosystem of AI builders, low-code/no-code tools, and agentic applications. His work focuses on securing AI-native development environments and building scalable methods for detecting, validating, and mitigating risks in AI-driven software workflows.
Previously, Yotam led the Threat Research team at Zscaler, headed the Vulnerability Research team at Rezilion, and held multiple roles within PayPal’s security organization across vulnerability management, threat intelligence, and insider threat.
Yotam is an active participant in several cross-industry working groups dealing with AI security, vulnerability management, and supply chain security.
Yotam Perkal (Pluto Security, IL)
AI is rapidly reshaping vulnerability management, and the upcoming years will determine whether defenders or attackers are gaining the upper hand. On the defensive side, AI promises meaningful progress: improved prioritization in the face of exponential vulnerability growth, better signal extraction from increasingly noisy data, faster identification of vulnerable components, and earlier insight into real-world exposure. As the rate of vulnerability disclosure continues to outpace remediation capacity, these capabilities are becoming essential to keeping VM programs viable. At the same time, AI is actively increasing pressure across the vulnerability ecosystem. Automated, low-effort vulnerability submissions (“AI slop”) are placing growing burdens on triagers, CNAs, and open-source maintainers. The technical barrier for effective exploitation is rapidly dropping, shortening the time from vulnerability discovery to weaponization and enabling more adaptive, personalized attacks at scale. Recent research and real-world incidents demonstrate that AI-powered attacks have moved from theory to practice, spanning nearly the entire MITRE ATT&CK lifecycle. This talk examines the AI arms race through a vulnerability management lens, highlighting both its defensive potential and its destabilizing effects. We explore where current workflows begin to fail when confronted with AI-driven discovery and exploitation, and what must change as a result. Rather than incremental optimization, defenders need to revisit foundational choices, from prioritization and disclosure to automation boundaries and system design, to remain effective in an environment shaped by autonomous, adaptive adversaries.
---
Yotam Perkal leads security research at Pluto Security, a next-generation AI security and governance platform designed to protect the rapidly emerging ecosystem of AI builders, low-code/no-code tools, and agentic applications. His work focuses on securing AI-native development environments and building scalable methods for detecting, validating, and mitigating risks in AI-driven software workflows.
Previously, Yotam led the Threat Research team at Zscaler, headed the Vulnerability Research team at Rezilion, and held multiple roles within PayPal’s security organization across vulnerability management, threat intelligence, and insider threat.
Yotam is an active participant in several cross-industry working groups dealing with AI security, vulnerability management, and supply chain security.
