Rethinking Vulnerability Management: How AI and Automation Reshape Organizational Routines and Supports Adaptive Cybersecurity Systems

Vulnerability management (VM) is becoming increasingly important as organizations face growing cybersecurity threats. This study examines how organizations adapt their vulnerability management routines in response to evolving vulnerability signals through the integration of artificial intelligence (AI) and automation. Drawing on data from an international fast-moving consumer goods (FMCG) company, we investigate how human expertise and AI interact across the full VM process, from triage to remediation. Using Organizational Routine Theory (ORT), we show that AI does not simply automate tasks but acts as a co-performer, influencing how decisions are made, work is coordinated, and actions are adapted. We develop a three-phase model capturing (1) the integration of AI-enabled automation into strained routines, (2) the manifestation of tensions between human expertise and automation as well as between usability and system complexity, and (3) the stabilization of hybrid routines through iterative adaptation and feedback loops. We identify two key tensions in this process: technology versus human expertise, and usability versus the complexity of multi-vendor tools. These tensions create frictions in practice but also open opportunities for learning and improvement. Rather than treating AI as a technical tool, our findings highlight its role as an active routine participant. Importantly, we show that routine evolution enables organizations to improve how vulnerability signals are interpreted and acted upon, thereby supporting more coordinated and adaptive cybersecurity practices. This has both theoretical implications for understanding how routines evolve with technology and practical relevance for improving adaptive cybersecurity practices. By linking micro-level routine dynamics to broader organizational outcomes, this study contributes to explaining how organizations sustain stable and adaptive operations under conditions of continuous cyber threat exposure.