AI-assisted CVE discovery is widening the exploitation gap

At a glance

What this is: Proofpoint says AI-assisted vulnerability discovery is increasing CVE volume faster than enrichment and prioritisation can keep up, while attackers still exploit new flaws with familiar playbooks.

Why it matters: Security teams need exploitation-led prioritisation because KEV and NVD coverage can lag active abuse, leaving exposed systems unprotected for too long.

By the numbers:

• Proofpoint telemetry shows 12 distinct 2026 CVEs being actively exploited in network-facing attacks, compared with 8 currently listed on the CISA KEV catalog.
• Proofpoint's network sensor infrastructure spans over 5,000 sensors globally and analysed more than 3 million alerts in 2026.
• Proofpoint says CISA lists 8 CVEs from 2026 while its telemetry has detected active exploitation attempts for 12 distinct 2026 CVEs.
• NIST said CVE submissions in Q1 2026 were nearly one-third higher than the same quarter last year.

Context

AI-assisted CVE discovery changes the speed of vulnerability creation, but not the basic logic of exploitation. Attackers still prefer public proof-of-concept code, exposed services, and familiar delivery chains; the governance problem is that cataloguing and enrichment now lag the pace at which newly disclosed flaws become operationally relevant.

For identity and access programmes, the deeper issue is prioritisation of externally reachable control points, not simply patch volume. Once attackers can move from disclosure to exploitation faster than platforms can enrich and rank the issue, teams have to treat exploitation signal as part of vulnerability governance rather than an after-action metric.

Key questions

Q: What should teams do first when a new CVE is already being exploited before KEV listing?

A: Treat active exploitation as the trigger, not KEV inclusion. Move the vulnerability into emergency triage, confirm whether exposed assets are affected, and prioritise remediation for internet-facing systems before lesser findings in the queue. If exploitation telemetry shows real attacker activity, the correct response is to re-rank risk immediately rather than waiting for formal catalogues to catch up.

Q: Why do AI-assisted CVE discovery and enrichment delays increase operational risk?

A: Because they widen the time between disclosure and enforceable action. Security teams receive more vulnerabilities faster, but the catalogues, scoring workflows, and governance processes used to prioritise them do not update at the same pace. That means real exploitation can begin before defenders have enough context to act, creating a persistent prioritisation gap.

Q: What are the signs that a vulnerability prioritization model is failing?

A: The clearest signs are long delays on known exploited vulnerabilities, tickets that lack ownership, duplicate findings across tools, and high-severity work that never maps to real attack paths. If the team keeps closing urgent-looking items without reducing exploitable exposure, the model is measuring activity rather than risk reduction.

Q: Should organisations trust KEV alone for remediation decisions?

A: No. KEV is useful, but it is reactive and will always lag some active exploitation. Organisations should use it alongside live telemetry, exposure context, and asset criticality so that remotely exploitable issues on internet-facing systems are handled before formal listing catches up.

Technical breakdown

Why AI-assisted discovery widens the exploit window

AI-assisted vulnerability discovery increases the number of published CVEs without changing how fast defenders can assign priority, enrich records, and patch. That creates a timing mismatch: newly disclosed flaws become exploitable before catalogues, scoring workflows, and ticket queues stabilise. The result is not a novel attack model but a denser stream of candidate weaknesses competing for the same remediation capacity. In practical terms, organisations need prioritisation logic that can absorb uncertainty and still rank internet-facing exposure correctly.

Practical implication: move newly disclosed, remotely exploitable flaws into high-priority handling before enrichment is complete.

Why exploitation telemetry beats catalogue-only prioritisation

Catalogue-based prioritisation assumes that public lists such as KEV and NVD will reflect real-world exploitation quickly enough to guide response. Proofpoint's data shows that assumption is no longer safe because active exploitation can appear weeks before formal inclusion. Sensor telemetry, blocked campaigns, and observed exploit attempts provide an earlier signal of what is actually being used against exposed assets. For defenders, exploitation evidence is now a primary input to remediation order, not a validation step after patching.

Practical implication: combine KEV and vulnerability scores with live exploitation telemetry when setting remediation queues.

Why attacker tradecraft still looks familiar

The article shows that faster CVE discovery does not automatically produce sophisticated new exploitation behaviour. Threat actors continue to use spear-phishing, authentication bypass, remote code execution, and chained exploitation against exposed perimeter services. That stability matters because defenders often overreact to novelty and underweight recurring patterns that remain effective at scale. The real change is supply-side pressure from more CVEs, not a wholesale reinvention of the intrusion playbook.

Practical implication: invest in controls for recurring entry vectors such as email, exposed management interfaces, and authenticated remote access.

Threat narrative

Attacker objective: The objective is to gain reliable initial access fast enough to exploit exposed systems before defenders have prioritised or patched the vulnerability.

1. Entry occurs when threat actors use newly disclosed CVEs in email-delivered lures or network-facing exploitation against exposed services.
2. Credential or code execution access follows when authentication bypass, RCE, or incomplete patch bypass flaws allow the attacker to execute payloads or gain a foothold.
3. Escalation and chaining happen when actors combine the initial flaw with additional vulnerabilities to reach reliable execution or broader control of the target environment.
4. Impact is achieved through backdoors, implants, ransomware deployment, website defacement, espionage, or persistence on exposed infrastructure.

Breaches seen in the wild

• Microsoft verified publisher OAuth phishing 2022: Malicious OAuth apps with a fraudulently obtained Microsoft verified publisher badge tricked UK users into granting mailbox access in 2022.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploitation-led prioritisation is replacing publication-led prioritisation. The article shows that a CVE's real risk is no longer determined by whether it exists in a database, but by whether it is already being used in the wild. That shifts vulnerability governance toward live exploitation evidence, especially for internet-facing systems and email delivery paths. Practitioners should treat exposure telemetry as a first-class control input, not an optional enrichment layer.

The exploitation gap is a governance gap, not just a tooling gap. Teams that still anchor patch queues to KEV alone are assuming formal cataloguing arrives quickly enough to protect them, and that assumption is now demonstrably weak. NVD enrichment lag and KEV reactivity mean the control failure sits in the prioritisation model itself. The practitioner conclusion is to rework vulnerability governance around observed exposure, not catalogue completeness.

AI-assisted CVE discovery is creating CVE governance debt. More findings do not automatically translate into better security when the intake, enrichment, and triage pipeline cannot keep pace. The result is a backlog of operationally relevant issues that remain under-prioritised until after exploitation starts. For security leaders, the message is to measure how fast discovered flaws become enforceable action, not how many disclosures the organisation can ingest.

Technical novelty is not the main attacker advantage here. Proofpoint's telemetry suggests that actors are still using mature delivery mechanisms such as spear-phishing, authentication bypass, and remote code execution against well-known exposure points. That means the weak link is not adversary creativity but the defender's time-to-priority. Practitioners should focus on shortening the interval between public disclosure and defensive action.

Network telemetry is becoming a governance control for vulnerability management. The article shows that formal catalogs can lag real exploitation by weeks, which makes sensor data and threat intelligence essential for material risk decisions. In identity-adjacent programmes, this especially matters where exposed remote access, mail systems, and management planes sit behind credentialed workflows. The practitioner conclusion is to align vulnerability governance with actual attack activity, not with publication dates alone.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• The 2026 Verizon DBIR found that exploitation of software vulnerabilities became the leading initial access vector in confirmed breaches, accounting for 31% of incidents.

What this signals

CVE governance debt is now a measurable operational risk. When discovery volume rises faster than enrichment and triage, the backlog becomes part of the attack surface. Security teams should assume that some exploitable flaws will arrive without enough metadata for a neat scoring workflow, and build decision rules that can operate under that uncertainty.

Exposure telemetry belongs in vulnerability governance, not just detection. Proofpoint's findings point to a simple reality: what attackers are using now is often more important than what a catalogue says later. For identity-adjacent services such as remote access and mail infrastructure, the practical answer is to combine patching with exposure-based prioritisation rather than relying on publication order alone.

For practitioners

• Prioritise exploitation evidence over KEV status Move newly disclosed remote code execution and authentication bypass issues to the front of remediation queues when telemetry shows active abuse, even if formal cataloguing has not caught up.
• Re-rank internet-facing assets first Treat perimeter devices, mail platforms, remote access systems, and web infrastructure as the first patch cohort because they are the most likely targets once proof-of-concept code is public.
• Use live telemetry in patch triage Blend sensor alerts, blocked exploit attempts, and threat intelligence with CVSS and KEV so the organisation prioritises what attackers are actually using now.
• Accelerate response for Microsoft ecosystem flaws Escalate Office and Windows zero-days to emergency handling when the disclosed flaw supports email-borne initial access or reliable code execution.
• Harden exposure paths that still work at scale Review phishing, exposed management interfaces, and remote access workflows for controls that reduce the value of publicly weaponised vulnerabilities.

Key takeaways

• AI-assisted discovery is accelerating the supply of CVEs, but exploitation still follows familiar paths that defenders already know how to disrupt.
• The main operational problem is not novelty in attacker behaviour, but the gap between active exploitation and formal vulnerability enrichment.
• Security teams need prioritisation models that combine live telemetry, exposed asset context, and catalogue data so remediation tracks real attacker activity.

Key terms

• Exploitation-led prioritisation: A remediation approach that ranks vulnerabilities by evidence of active use, exploit availability, and exposure in the environment rather than by severity score alone. It aligns patch effort to attacker behaviour, which makes limited maintenance windows more effective.
• CVE enrichment lag: The delay between a vulnerability's publication and the point at which catalogues, metadata, and risk context are complete enough to support reliable triage. In fast-moving environments, that lag creates a blind spot where exploitability is known by attackers before defenders can prioritise it well.
• Hidden Attack Surface: Hidden attack surface is the part of an environment attackers can use without standing out in normal authentication monitoring. For identity teams, it often appears where connected apps, tokens, and service accounts are trusted across systems but are not reviewed as one access chain.
• Telemetry-driven triage: The practice of using sensor data, blocked exploits, and observed attack attempts to decide what to patch first. It is a stronger control than static scoring alone because it reflects current attacker behaviour rather than relying on eventual catalogue updates.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance, machine identity control, and broader security decision-making.