The SANS VulnOps Field Guide (also available as a PDF) proposes a seven-phase decision loop, from intake through independent verification, for organizations whose vulnerability intake has outgrown anything a ticket queue can drain. The term itself comes from an October 2025 essay by Heather Adkins, Gadi Evron and Bruce Schneier, which expected AI-assisted vulnerability research to grow into an operational discipline the way DevOps did for software delivery. The motivating number: NIST enriched nearly 42,000 CVEs in 2025, 45% more than in any prior year, and still fell behind, so the NVD now enriches known-exploited, federal and critical software first and files the rest under “Lowest Priority”. AI-assisted vulnerability discovery is about to make that backlog considerably worse. The guide’s governance guardrails keep AI in the recommender seat rather than the executor seat, and the suggested metrics are built to tell genuine remediation apart from a well-groomed exception queue, because “risk accepted” remains the enterprise’s favorite way to spell “unpatched”.
