{"id":2824,"date":"2026-09-14T13:20:33","date_gmt":"2026-09-14T13:20:33","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2824"},"modified":"2026-09-14T13:20:33","modified_gmt":"2026-09-14T13:20:33","slug":"ai-changed-the-exposure-problem-validation-needs-to-change-with-it","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2824","title":{"rendered":"AI Changed the Exposure Problem. Validation Needs to Change With It."},"content":{"rendered":"
\n
<\/a><\/div>\n

There’s a lot of noise around AI and cybersecurity right now. What\u2019s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action.<\/strong><\/p>\n

In the first half of 2026, a whopping 35,853 CVEs were published, roughly 49%<\/a> more than in the year before. Yet only 495 were catalogued<\/a> as exploited in the wild during that same period, and 116 were already under attack on the day they became public. Meanwhile, Anthropic\u2019s own disclosure data<\/a> shows Mythos-class models surfacing 26,153 vulnerability candidates in open-source software, with only 421 of those<\/a> getting patched upstream.<\/p>\n

That small exploited subset is a very important point. It tells defenders that treating every vulnerability with a High or Critical CVSS rating as an emergency is not only impossible, it\u2019s actually the wrong model<\/strong>. The critical task security teams face is deciding which exposures, on which assets, require immediate action<\/strong>, especially as both the number of findings grows and the gap between disclosure and exploitation narrows.<\/p>\n

The CVSS Alone Can\u2019t Tell You What Matters in Your Environment<\/strong><\/h2>\n

The same CVE can affect hundreds of assets, but the impact is rarely the same across them<\/strong>. Some instances are unreachable. Some sit behind controls that interrupt the techniques required for exploitation. Others are exposed on business-critical systems where prevention fails, and detection never fires.<\/p>\n

The CVSS gives you a common severity baseline. It can\u2019t give you the context that determines impact to your organization.<\/strong><\/p>\n

This is why defenders need evidence from their own environment to find out whether the exposure is actually exploitable, which assets it affects, and whether those assets are reachable and important to the business. As vulnerability volume grows, this distinction becomes more and more important.<\/p>\n

Automated Pentesting Alone Can\u2019t Validate Every Exposure<\/strong><\/h2>\n

Once you move beyond severity scores, automated pentesting gives you some of the strongest evidence you can gather. It can run real exploits, prove that an exposure is exploitable in your environment, chain vulnerabilities, credentials, and misconfigurations into attack paths, and show how far an attacker could actually progress across your network.<\/p>\n

<\/p>\n

Yet coverage remains limited in practice. Omdia research<\/a><\/strong> found that while 95% of organizations rank pentesting as a top or high priority, only 32% of their average attack surface is tested each year.<\/strong> Agentic and automated approaches can expand that coverage, but they don\u2019t remove every constraint of live exploitation<\/strong>.<\/p>\n

For CVE-based exploitation, a working exploit still has to exist, and the target has to be safe to test.<\/strong> Newly disclosed CVEs may have no working exploit yet, while it simply may not be possible to test a live exploit on business-critical, restricted, and air-gapped assets. Those exposures still need an exploitability verdict, even when there\u2019s nothing an automated pentest can safely run.<\/p>\n

This is the gap automated pentesting can\u2019t close on its own. It\u2019s a required part of validation<\/strong>, but it can\u2019t validate every exposure<\/strong>.<\/p>\n

All for One. One for All Exposures.<\/strong><\/h2>\n

This is where the pieces come together.<\/p>\n