When to Stop Building Features and Fix Security: Lessons From Epic's Six-Week Pause

Epic, one of the largest software vendors in healthcare, stopped most new development for six weeks to fix security flaws an AI model found in its own code. The decision is unusual — and it is likely to become less unusual as AI scanning tools surface years of hidden bugs at once.

Signs a Pause Is Warranted

• Findings that allow access without leaving logs — they hide every other problem and make breaches undetectable.
• Flaws that expose regulated or sensitive data: health, financial, identity documents.
• A backlog of serious findings that would take more than a quarter to clear at your normal pace.
• Evidence or credible intelligence that a vulnerability class is being actively exploited.

How to Run a Security Pause

• Triage first: rank every finding by exploitability and impact, not by how easy it is to fix.
• Set a fixed duration and a clear exit criterion — for example, zero critical and high findings open.
• Keep a small team on urgent customer issues so the business doesn't stall entirely.
• Fix the class, not the instance: if one endpoint lacked an authorization check, audit them all.
• Add tests that would have caught each bug, so it can't return.

Tell Customers the Right Amount

A pause delays roadmap promises. A short, honest note — that you are prioritizing security work for a defined period — usually builds more trust than silence. Save technical details until fixes are deployed.

Plan for AI-Speed Discovery

If you run AI security scans on a large codebase for the first time, expect more findings than usual. Budget remediation capacity before you scan, and fix the most dangerous categories first. Finding bugs is only useful if you can close them.