We used to treat every CVE as an alert… That works when a serious vulnerability is a monthly event. It doesn't anymore. In 2025 the Linux kernel was the single most-reported product on the planet, with thousands of CVEs, roughly ten every day, from one project. And its maintainers don't even rank them by severity, so you can't wait for the "important" ones. Then the AI era poured fuel on the fire: 2026 is on track for 66,000 CVEs, and a single AI model (Claude Mythos) recently surfaced thousands of high-severity flaws that remain 99% unpatched. The flood is now machine-speed.

When a CVE lands every few minutes, you can't sound the alarm every time. So we stopped. Today patching is just part of the workflow, and we fight AI with AI: automation ingests and rolls out the patches, while AI triages the flood down to what is actually exploitable for each deployment. This talk shows how a small team keeps hundreds of Keycloak clusters and thousands of vulnerabilities under control, everywhere and anytime, without adding a single delay to the roadmap.

Preferred duration: 45 minutes. an expandable 60-minute version is available.

Target audience: DevOps, platform, SRE and security engineers who run open-source software in production, and anyone responsible for keeping systems patched at scale. Intermediate level. Assumes basic familiarity with CI/CD and what a CVE is; no Keycloak knowledge required.