AI just changed the math on software vulnerabilities. Here’s what we’re doing about it.
Threat discovery used to be slow, expensive, and manual. That era is over.
The emergence of agentic AI tools like Mythos has fundamentally changed the urgency and responsibility of vulnerability management for software vendors. Threat discovery is now cheap, fast, and intelligent, allowing vulnerabilities to be detected at a significantly higher rate with more precision and depth, regardless of their criticality. Furthermore, these technologies can chain vulnerabilities together, associating individual minor Common Vulnerabilities and Exposures (CVEs) into multi-step exploits, thus changing the game by making CVEs of any severity a major risk to the platform and organization.
We built for this
Agentic AI didn't catch us off guard. The direction was predictable, so we hardened our products ahead of the curve, before the wave of new vulnerability reports arrives. The point is simple: the fixes are in place by the time a vulnerability is identified, so you're covered in advance instead of scrambling after. This work includes, but isn't limited to:
- Expanding and enhancing the proactive vulnerability scanning we execute into our software, development workflows, and CI pipelines to uncover vulnerabilities across the entire application stack, including open-source 3rd party libraries, and their associated dependencies.
- Purpose-built migration tools that make the move from current versions to hardened versions structured and low-impact, with PKWARE engineering support.
A new approach to product lifecycle support
As a result of the impact of these new technologies and the expected surge of new reported vulnerabilities, PKWARE has revised our Product Lifecycle Support and Vulnerability Mitigation policies to better reflect the new threat paradigm to ensure the security of our products and the customer environment in which they operate. Also, instead of using product release versions as the guiding principle for how long a version is supported, we will now use a time-based approach. When a new minor or major product version is released, we will designate and publish the end of support date for that version, at that time. In general, the expected support term will be 15 months from the general availability (GA) date, however the terms of support may vary for different versions to allow for ultimate flexibility, responsiveness to security and market conditions, and adaptability for our customers.
Our new vulnerability and support policies pair to give customers product-specific upgrade plans to quickly and effectively migrate to the hardened, actively supported versions of our PKWARE products with minimal impact to their existing operations.
What this means for you
We recognize this represents a meaningful shift in how we communicate and deliver product support commitments. It reflects the reality of the current threat landscape and our commitment to keeping your environment secure. Please reach out to your PKWARE account team with any questions or to begin migration planning.
None of us asked for the threat landscape to change this fast. But it has, and pretending otherwise would not serve you. The changes I've outlined here are how we stay ahead of it together, so the software protecting your most sensitive data is never the weak link.
If you have questions, or you just want to talk through what this means for your environment, my team and I are here. Reach out to your account team and we'll get you a plan.
Thank you for trusting us with your data.
Jason Dobbs
Chief Technology Officer, PKWARE
Frequently Asked Questions
Why is PKWARE changing the way it supports product versions?
Vulnerability discovery has gotten much faster and cheaper because of agentic AI tools. Software vendors across the industry are tightening lifecycle support windows to reduce the time customers spend on versions that are out of active hardening. PKWARE is moving from version-based to time-based support so customers always know exactly when a version’s coverage ends.
What is the new support term?
Generally 15 months from the general availability (GA) date of each minor or major version. The specific End of Support (EOS) date is published when the version is released, so it’s never a moving target.
Does this change affect my current contract or SLA?
No. Existing contractual commitments stand. The new policy governs how PKWARE communicates lifecycle dates for versions going forward. If your contract has specific support obligations that conflict with a published EOS date, the contract governs. Contact your account team to confirm.
What support does a version get during its lifecycle?
Security patches for vulnerabilities in PKWARE-built code continue through the published EOS date. Bug fixes are evaluated case by case for critical issues. New features land in current releases, not older ones.
What happens when a version reaches End of Support?
The path forward is to move to the current supported version.
Will PKWARE keep shipping security patches after End of Support?
No. After EOS, security remediation comes through upgrading to the current supported version. PKWARE will not back-port patches to versions past their EOS date.
What is the recommended migration path for DSM customers?
PK Protect Data Store Manager (DSM) v10 is the current hardened release. All customers on 8.10.5, 9.1, and 9.2 should plan migration to v10. Your account team can walk you through the path specific to your deployment.
What is the recommended migration path for PEM customers?
Move to the most recent PEM Administrator / Agent version. Your account team can walk you through the path specific to your deployment.
My change-control cycle is longer than 15 months. What are my options?
Contact your account team early. PKWARE works with customers whose change cycles need more runway and can help you sequence the move ahead of your published EOS date.
Will migrating to the new version cost anything additional?
Migration to a current supported version is included under active maintenance. Migration services (planning, deployment support, testing assistance) are available separately. Your account team can scope what your environment needs.
Where do I get migration help?
Your PKWARE account team is the starting point. They’ll loop in customer success, professional services, and product engineering as needed.
Threat discovery used to be slow, expensive, and manual. That era is over.
The emergence of agentic AI tools like Mythos has fundamentally changed the urgency and responsibility of vulnerability management for software vendors. Threat discovery is now cheap, fast, and intelligent, allowing vulnerabilities to be detected at a significantly higher rate with more precision and depth, regardless of their criticality. Furthermore, these technologies can chain vulnerabilities together, associating individual minor Common Vulnerabilities and Exposures (CVEs) into multi-step exploits, thus changing the game by making CVEs of any severity a major risk to the platform and organization.
We built for this
Agentic AI didn't catch us off guard. The direction was predictable, so we hardened our products ahead of the curve, before the wave of new vulnerability reports arrives. The point is simple: the fixes are in place by the time a vulnerability is identified, so you're covered in advance instead of scrambling after. This work includes, but isn't limited to:
- Expanding and enhancing the proactive vulnerability scanning we execute into our software, development workflows, and CI pipelines to uncover vulnerabilities across the entire application stack, including open-source 3rd party libraries, and their associated dependencies.
- Purpose-built migration tools that make the move from current versions to hardened versions structured and low-impact, with PKWARE engineering support.
A new approach to product lifecycle support
As a result of the impact of these new technologies and the expected surge of new reported vulnerabilities, PKWARE has revised our Product Lifecycle Support and Vulnerability Mitigation policies to better reflect the new threat paradigm to ensure the security of our products and the customer environment in which they operate. Also, instead of using product release versions as the guiding principle for how long a version is supported, we will now use a time-based approach. When a new minor or major product version is released, we will designate and publish the end of support date for that version, at that time. In general, the expected support term will be 15 months from the general availability (GA) date, however the terms of support may vary for different versions to allow for ultimate flexibility, responsiveness to security and market conditions, and adaptability for our customers.
Our new vulnerability and support policies pair to give customers product-specific upgrade plans to quickly and effectively migrate to the hardened, actively supported versions of our PKWARE products with minimal impact to their existing operations.
What this means for you
We recognize this represents a meaningful shift in how we communicate and deliver product support commitments. It reflects the reality of the current threat landscape and our commitment to keeping your environment secure. Please reach out to your PKWARE account team with any questions or to begin migration planning.
None of us asked for the threat landscape to change this fast. But it has, and pretending otherwise would not serve you. The changes I've outlined here are how we stay ahead of it together, so the software protecting your most sensitive data is never the weak link.
If you have questions, or you just want to talk through what this means for your environment, my team and I are here. Reach out to your account team and we'll get you a plan.
Thank you for trusting us with your data.
Jason Dobbs
Chief Technology Officer, PKWARE
Frequently Asked Questions
Why is PKWARE changing the way it supports product versions?
Vulnerability discovery has gotten much faster and cheaper because of agentic AI tools. Software vendors across the industry are tightening lifecycle support windows to reduce the time customers spend on versions that are out of active hardening. PKWARE is moving from version-based to time-based support so customers always know exactly when a version’s coverage ends.
What is the new support term?
Generally 15 months from the general availability (GA) date of each minor or major version. The specific End of Support (EOS) date is published when the version is released, so it’s never a moving target.
Does this change affect my current contract or SLA?
No. Existing contractual commitments stand. The new policy governs how PKWARE communicates lifecycle dates for versions going forward. If your contract has specific support obligations that conflict with a published EOS date, the contract governs. Contact your account team to confirm.
What support does a version get during its lifecycle?
Security patches for vulnerabilities in PKWARE-built code continue through the published EOS date. Bug fixes are evaluated case by case for critical issues. New features land in current releases, not older ones.
What happens when a version reaches End of Support?
The path forward is to move to the current supported version.
Will PKWARE keep shipping security patches after End of Support?
No. After EOS, security remediation comes through upgrading to the current supported version. PKWARE will not back-port patches to versions past their EOS date.
What is the recommended migration path for DSM customers?
PK Protect Data Store Manager (DSM) v10 is the current hardened release. All customers on 8.10.5, 9.1, and 9.2 should plan migration to v10. Your account team can walk you through the path specific to your deployment.
What is the recommended migration path for PEM customers?
Move to the most recent PEM Administrator / Agent version. Your account team can walk you through the path specific to your deployment.
My change-control cycle is longer than 15 months. What are my options?
Contact your account team early. PKWARE works with customers whose change cycles need more runway and can help you sequence the move ahead of your published EOS date.
Will migrating to the new version cost anything additional?
Migration to a current supported version is included under active maintenance. Migration services (planning, deployment support, testing assistance) are available separately. Your account team can scope what your environment needs.
Where do I get migration help?
Your PKWARE account team is the starting point. They’ll loop in customer success, professional services, and product engineering as needed.
