The cost of finding a vulnerability has fallen to almost nothing. What used to take a researcher years of expertise and expensive tooling now takes a developer with a model and a fuzzer, and the researcher pool is not going from thousands to tens of thousands. It is going toward millions.
The numbers already moved. 2024 saw roughly 40,000 published CVEs, a 38 percent jump over 2023, the largest single-year increase in the history of the program, and the curve gets steeper from here. Discovery was never the bottleneck for medical devices anyway. A modern device carries millions of known vulnerabilities across firmware, embedded software, a web app, a mobile app and the networks between them. Almost none are exploitable in that specific product. A few could hurt a patient. The job is to separate the few from the many, and in a regulated product you cannot just assert that separation, you have to evidence it.
That is where the volume breaks things. Manually triaging machine-generated findings repeats the mistake that broke the annual pentest: human hours spent on output that machines produce for free. The only response that scales is to stop touching findings by hand, automate the context and the attempted verification, and settle exploitability on the running product instead of in a triage meeting. Not more scanners. A second layer that decides what is real.