The scanner never clocks out. The audit still does.

Here is an uncomfortable observation from the finder's side of the fence. The most interesting flaw I ever reported was not hiding. It sat on a public-facing page in T-Mobile's web estate – a clickjacking setup, two evenings of patient layering, no exotic tooling – and no one had reached it before a stranger with a browser did. I disclosed it responsibly and ended up on their public bug-bounty Hall of Fame. The process that followed felt oddly familiar: an acknowledgement SLA, a severity negotiation, a quiet embargo until the fix shipped. It was a customer escalation in all but name, except this one came from outside and was holding the door open out of courtesy.

Google's threat intelligence group now reports that AI is accelerating vulnerability discovery across enterprise and critical-infrastructure attack surfaces. Machines are enumerating flaws in controllers, gateways and inherited OT estates faster than any human finder has ever worked, while the industrial sector absorbs roughly 31% of global ransomware activity, with one strain dominating the field. Run the arithmetic. Your defect population did not grow. The rate at which someone finds it did.

You already lived this on the line

When we stood up the QA/QC function at the SNOP greenfield plant – 900+ employees, quality built from an empty floor before the first part moved – the trap I was determined to avoid was the one every plant falls into when inspection gets automated. Vision systems and end-of-line testers do not reduce your workload. They multiply your findings. A camera that flags forty suspect surfaces a shift is worthless if the queue behind it holds three engineers and a weekly meeting.

Detections are cheap. Decisions are expensive.

So we designed the disposition flow before the first finding arrived: severity classes agreed with the customer in advance, containment rules anyone on shift could trigger, QRQC for what a cell could kill in 24 hours, 8D for anything that escaped. Within a quarter the plant recorded zero critical customer escalations. Not because we found fewer defects than the industry – because nothing that mattered sat in a queue waiting for a committee. Detection stopped being the constraint years ago. Disposition is the constraint, and it has to be budgeted like capacity, not like paperwork.

A vulnerability is a nonconformance with an expiry date

Strip the vocabulary away and a vulnerability is a nonconformance: a deviation from requirement, found, classified, contained, dispositioned, verified. One difference matters. A classic NC sits in your queue until you act on it. A vulnerability sits in a queue that other people are also working – researchers, criminal groups, AI agents working for both – and the day one of them finds it first, your disposition timeline collapses from "next audit" to "now".

A defect's due date is your schedule; a vulnerability's is somebody else's curiosity.

That is why severity-based disposition, the boring spine of IATF 16949 work, transfers so cleanly. Not every finding deserves an 8D. None of them ever did. Intake classification is the whole game: does it stop the line, can containment segregate it today, is it an escape risk to the customer. A clickjacking page and remote code execution on an HMI are both "findings"; only one of them ends a company's quarter. Escape analysis transfers even better. In quality, the number that matters is never how many defects you found – it is what got past you to the customer. In security the customer is the adversary, and an escape is a finding somebody else dispositions for you, in public, on a date of their choosing.

Rebuild the cadence, not the coverage

When findings multiply, the instinct is to buy more inspection – another scanner, another pen test, another audit of the OT estate. That is the plant mistake repeated at enterprise scale. Coverage is no longer the constraint. The calendar is. A control estate that is formally audited twice a year and continuously probed by outsiders is mismatched to its own discovery rate by orders of magnitude, and the recent incident record says it plainly: a medical-device maker halted production through an IT-OT dependency chain that began at a single developer workstation; a national rail operator was compromised through web infrastructure sitting on someone else's perimeter. Neither finding was exotic. Both simply existed, and nobody owned disposition at the speed the environment changed. An unplanned week down at a body-in-white plant runs comfortably into seven figures of €.

What quality people bring to this is not tooling; security teams own the tooling and are good at it. We bring queue discipline. WIP limits on open findings, enforced the way you enforce them on a line. Severity-based SLAs built containment-first: segment and isolate today, permanent fix on plan. A daily QRQC-style huddle for what can be contained now, 8D for escapes, and a weekly wall review with real authority – the kind where standing in front of an open red item is uncomfortable enough that things close. Escapes are reviewed as system failures, never individual blame. Blame is how queues get hidden.

The uncomfortable question is no longer whether your systems contain flaws. They do, and always did – the scanners simply stopped letting us pretend otherwise. The question is who finds them first, and what your queue does in the first 24 hours after that. Security teams own the tooling but rarely the disposition discipline, because nobody ever taught it to them as a discipline. I have run that exact function on shop floors for two decades, and the plants that drowned in open findings after automating inspection already showed us what happens when discovery outruns triage. The scanner never clocks out. The audit still does. Until that gap closes, the stranger with the browser sets your schedule.