Vulnerability volume down 20%.
91 critical flaws eliminated.

AI could generate answers faster than anyone could own them.

Defence Digital was contending with a fast-growing volume of vulnerabilities across complex Ministry systems, running on an unsustainable ‘patch everything’ posture that made prioritisation slow, inconsistent and operationally risky.

The deeper issue was governance, not throughput. Triage relied on fragmented manual judgement with no escalation architecture for low-confidence AI outputs or high-impact decisions, and no audit trail for prioritisation, exceptions, approvals or oversight. Introducing AI-assisted triage risked outrunning the organisation’s ability to define who was accountable for what.

Three constraints were non-negotiable:

• Low-confidence AI outputs and high-impact decisions needed a formal escalation path, not ad hoc judgement
• Prioritisation, exceptions, approvals and oversight all needed a complete, audit-ready decision trail
• AI had to stay recommendation-only — humans needed to remain the accountable decision-makers for every consequential call

AI recommends. Humans decide. Every step is logged.

Defence Digital designed the Vulnerability Management Support Team (VMST) and a human-machine teaming model: AI ranks, clusters, summarises and flags anomalies across vulnerability data, while humans retain authority for prioritisation, trade-offs, exceptions and sign-off. The whole system runs under a ‘Reliable, Resilient, Responsible’ AI governance framework, built to keep pace under pressure without giving up control or assurance.

A new risk-scoring methodology, V-Score, replaced static scoring with a structured, evidence-based approach that adapts to organisational context — benchmarked to outperform the CVSS industry standard, and peer-reviewed and published in the Journal of Cyber Security (July 2025) as ‘An Open and Adaptable Approach to Vulnerability Risk Scoring’. The triage and exception workflow was redesigned to capture a complete decision trail — rationale, inputs, approvals and timing — creating an audit-ready assurance record.

Confidence cues, escalation triggers and mandatory human-in-the-loop checkpoints ensure low-confidence or high-risk cases always reach a human before action is taken. The division of labour is formal and fixed: AI is recommendation-only by design, and humans remain the accountable decision-makers for every consequential action.

Two years of backlog, cleared in three months.

Consistency across teams and shifts improved as a governed, repeatable triage model replaced fragmented manual judgement — proof that AI can accelerate cyber remediation in a national security environment without compromising the human accountability the mission demands.