Patching cannot fix the lazy habits that create security holes, a ServiceNow lead says

Patching code will not remove the weaknesses that careless routines create, argued Michael Freeman of ServiceNow. He is the company's senior director of threat research, and he spoke on The Cognitive Revolution. In his view, some of the riskiest holes start in how people work, not in the software.

What was said

Host Prakash Narayanan asked how a company with decades of old systems could reach zero known vulnerabilities in two years. He had taken that goal from Jason Clinton, Anthropic's deputy chief information security officer.

Freeman said many people working on AI do not know cybersecurity and see it as a software problem. A typical tech stack holds millions of software flaws, he said. But "it's the business processes that actually introduce some of the most critical vulnerabilities that we have."

He gave three examples. Managers sign off on a list of risks without understanding them. Staff put a customer's API keys, the secret codes that let programs log in, into a support ticket. A help desk gives everyone the same default password after a reset. According to the machine transcript, which is garbled at this point, that password must be replaced within 24 hours. Freeman said this is where humans get lazy.

He had heard proposals to use AI to find flaws, patch them and modernize old systems fast. He called these partly true, but said their backers do not understand the business. He added that "the business processes that introduce the vulnerabilities are always going to be there."

Why it matters

Our reading: none of these examples is something a patch can reach. A key pasted into a ticket works for anyone who can read that ticket, and no software update cancels it. Closing these holes means changing the routine, not the code.

The shared reset password is temporary, but the risk is the window in which a known default stays live. For managers who sign security budgets, the questions change. When a vendor promises to patch toward zero, ask what it does about tickets, help desks and sign-offs. Then check your own: where do keys end up in tickets, and what password does the help desk hand out?

The other side

Freeman did not call AI useless for defence. He said the find-and-patch proposals are partly true. The excerpts give no data on how often process failures cause serious incidents, so they show his case as argument, not measurement.

The excerpts also include no remedy from Freeman for changing the habits themselves. How a company would get managers and help desks to work differently is not covered in what we have.