AI has not yet surged zero-day volume, but exploit speed has

At a glance

What this is: SafeBreach argues that frontier AI has advanced offensive capability, but the data still shows only limited AI-linked zero-day discovery and a more dangerous compression of exploit timelines.

Why it matters: That matters because IAM, NHI, and security teams need to prioritise exposure windows, compensating controls, and validation of real attack paths rather than assuming AI will immediately multiply zero-day volume.

By the numbers:

• Mandiant’s mean time-to-exploit hit negative seven days in 2025, showing exploitation now often precedes patch availability.
• 200 of roughly 46, roughly 46,000 published CVEs in 2025 were publicly credited to AI-assisted discovery, according to Barracuda’s Mythos Hype Index tracker.
• GTIG tracked about 90 zero-day vulnerabilities in 2025, with 43 aimed at enterprise products.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

👉 Read SafeBreach's analysis of how AI is reshaping the zero-day lifecycle

Context

AI-powered offensive capability is no longer theoretical, but the security problem is not simply that models can find bugs faster. The operational gap is that vulnerability discovery, exploit development, and patch deployment now move on different timelines, which makes exposure window a more useful metric than raw CVE counts for cyber and identity programmes.

That gap matters for IAM and NHI governance because identity infrastructure, edge devices, and credentials are increasingly the shortest path from discovery to impact. When exploitation can precede patching, controls such as access restriction, secret hygiene, runtime monitoring, and continuous validation become part of the same governance problem rather than separate teams.

The article’s starting position is typical of current frontier security debates: the capability leap is real, but the business impact depends on whether defenders can prove their controls work against current techniques, not just whether models can generate impressive demos.

Key questions

Q: What breaks when patching cannot keep up with AI-speed exploitation?

A: Patch-first programmes assume defenders have enough time to validate, approve, and deploy fixes before attackers operationalise a flaw. When disclosure-to-exploitation shrinks to hours, that assumption fails. Security teams then need containment, segmentation, and identity scope reduction to limit damage while remediation catches up.

Q: Why do identity and access controls matter more when zero-day timelines compress?

A: Because once exploitation windows shrink, attackers need only a brief opportunity to turn a vulnerable service into credential access or lateral movement. Strong identity controls reduce the blast radius of that foothold and make it harder for a single exploit to become domain-wide compromise.

Q: How do security teams know whether AI-related threat capability is actually affecting their programme?

A: Look for changes in exposure window, not just more alerts. If high-risk assets remain exploitable for days while attack paths are repeatedly validated in testing, then the programme is not keeping pace, even if patch counts or vulnerability queues appear stable.

Q: What should teams do when exploit timelines are shorter than patch cycles?

A: Prioritise containment before completion of the attack path. That means tightening access, rotating exposed secrets, segmenting critical services, and validating that existing controls can stop real techniques while patching catches up.

Technical breakdown

Why AI changes exploit discovery but not the zero-day lifecycle on its own

Frontier models can accelerate reconnaissance, code analysis, exploit proof-of-concept generation, and chaining of multiple weaknesses into a working intrusion path. That does not automatically translate into a higher public zero-day count, because discovery still has to pass through disclosure, weaponisation, targeting, and operational deployment. The article’s data shows that AI is strongest at the front of the lifecycle, while the later stages remain constrained by targeting priorities, patching, and adversary tradecraft. For identity-heavy environments, the most exposed assets are often not the application itself but the credentials and access paths wrapped around it.

Practical implication: Treat AI as an accelerator of exploit development and validation, not a reason to assume every vulnerability class will spike equally.

Why negative mean time-to-exploit matters more than CVE volume

Mean time-to-exploit turns negative when defenders are patching after exploitation is already underway for a meaningful slice of the population. That metric captures a structural mismatch between publication, remediation, and attacker execution. The important point is not only that exploit timelines compress, but that the window where compensating controls must hold gets shorter even when patch teams do not speed up. For IAM and NHI programmes, any exposed credential, API key, or privileged path becomes more dangerous when the exploitation window is measured in minutes or days rather than weeks.

Practical implication: Anchor governance to exposure window, not patch intention, and use compensating controls where remediation cannot move fast enough.

Why Adversarial Exposure Validation is becoming the practical control model

Adversarial Exposure Validation, or AEV, is the discipline of proving that real attacker techniques are blocked in production conditions. It matters because AI-driven capability gains make static assumptions unreliable, especially when attack chains involve identity infrastructure, edge devices, or privileged sessions. AEV is not a replacement for patching or configuration management. It is the layer that tells you whether your actual controls stop current techniques, including paths that reach identity stores, secrets, and access brokers. In environments with NHI sprawl, continuous proof beats periodic attestation.

Practical implication: Use validation to test whether compensating controls actually stop exploit paths before attackers complete them.

Threat narrative

Attacker objective: The attacker’s objective is to turn a newly exposed weakness into rapid operational access before remediation catches up.

1. Entry occurs when an attacker or AI-assisted tool identifies a vulnerable external service, edge device, or identity-adjacent system that can be reached before patching is complete.
2. Escalation follows when the initial foothold is chained into credential access, privilege escalation, or lateral movement across connected systems, including identity and access infrastructure.
3. Impact is achieved when the attacker completes the intrusion path before defenders close the exposure window, resulting in control bypass, data access, or domain compromise.

NHI Mgmt Group analysis

AI capability has outrun defender assumptions, but not every metric should be interpreted as a zero-day explosion. The article’s core value is that it separates frontier model capability from market-wide exploitation volume. That distinction matters because security teams often over-rotate on headline capability while under-investing in exposure management. The practical conclusion is that AI should be treated as a force multiplier for attacker workflow, not as evidence that every vulnerability pipeline has already broken.

Exposure window is the named concept security leaders should adopt now. The useful question is no longer how many vulnerabilities exist, but how long a controllable weakness remains exploitable before compensating controls or patches close it. That framing aligns better with NIST-CSF, NIST SP 800-53, and operational resilience thinking than raw CVE counting. Practitioners should measure the real time between disclosure, detection, and effective containment.

Identity infrastructure is now central to the exploit lifecycle, not adjacent to it. The article shows the attacker’s centre of gravity moving toward enterprise products, identity systems, and edge controls. That is an IAM and NHI governance issue as much as a vulnerability issue, because credentials, tokens, and privileged access often determine whether an initial exploit becomes a full compromise. Teams should treat identity paths as part of exploit prevention, not just post-breach investigation.

Adversarial Exposure Validation is the governance response to AI-accelerated threat testing. Static policy and annual reviews do not tell you whether current techniques are actually blocked. AEV gives security leaders a way to continuously test compensating controls against real attack paths, including privilege escalation and credential abuse. The practitioner conclusion is straightforward: validate control effectiveness continuously or accept that your assurance model is already stale.

The market signal is not that AI has replaced traditional offensive tradecraft, but that it is compressing the time between discovery and usable exploitation. That shift rewards organisations that can move from alerting to containment quickly and punishes those that still rely on periodic review cycles. For identity programmes, that means lifecycle discipline, least privilege, and rapid revocation now sit on the critical path of exposure reduction.

What this signals

Exposure-window thinking will matter more in AI-era vulnerability management. Teams that still organise remediation around monthly queues will struggle as exploit development and disclosure compress into the same operational window. The practical shift is toward continuous validation, faster revocation, and tighter control of identity-adjacent assets. The NIST SP 800-53 Rev 5 Security and Privacy Controls remains relevant here, but only if it is applied as a live control model rather than a documentation exercise.

Identity governance is becoming part of exploit containment. When the shortest route from vulnerability to breach runs through credentials, tokens, or privileged access, lifecycle discipline becomes a resilience control. That is why the NHI Lifecycle Management Guide is relevant beyond pure identity teams: it shows how rotation, offboarding, and visibility reduce the time attackers have to turn a flaw into impact.

AI-generated attacker capability will keep pressuring assurance models faster than annual review cycles can absorb. Organisations should prepare for more testable, more repeatable attack paths rather than assuming dramatic volume increases. The useful response is to validate against real technique sets, including the OWASP Non-Human Identity Top 10, so that controls are judged by what they stop, not by what they promise.

For practitioners

• Measure exposure window across critical attack paths Track the time between vulnerability disclosure, first detectable abuse, and effective containment across internet-facing systems, identity infrastructure, and privileged access paths. Use that metric to prioritise response work instead of relying on patch SLAs alone.
• Validate compensating controls against current techniques Run adversarial exposure validation against the exact attack paths most likely to matter in your environment, including credential access, privilege escalation, and lateral movement. Confirm that controls still block the technique before assuming remediation is complete.
• Shorten identity and secrets exposure windows Treat exposed credentials, tokens, and service accounts as urgent operational risks. Revoke, rotate, and reduce privilege quickly, especially where identity-adjacent assets could turn a vulnerability into a full compromise.
• Reassess patch priorities for identity-adjacent assets Give extra weight to VPNs, edge devices, SSO components, and other identity-adjacent control planes because they often sit on the shortest path from exploitation to domain-wide impact. Use that risk lens in change and remediation planning.

Key takeaways

• AI has clearly improved offensive capability, but the data still shows a modest share of publicly credited zero-days rather than a wholesale surge.
• The bigger operational problem is compression of exploit timelines, which makes patching alone an unreliable defence when exposure windows are shrinking.
• Practitioners should shift toward continuous validation, faster identity control, and exposure-window management because those are the controls that change breach outcomes.

Key terms

• Adversarial Validation: Adversarial validation is the practice of testing a model or system against realistic attack patterns before and after deployment. It checks whether hidden instructions, multi-turn pressure, and malicious context can change behaviour. For enterprise GenAI, it is more useful than synthetic benchmark confidence because it reflects live operational risk.
• Exposure Window: The period in which a credential, session, or privilege grant can be exploited before it is revoked or expires. Shorter windows help, but they do not solve the deeper question of whether the access remains justified for the full time it is active.
• Zero-day user lifecycle: A zero-day user lifecycle is an onboarding and offboarding model that begins as soon as the authoritative business event occurs, usually an HR action. Instead of waiting for manual tickets, the organisation automates identity, device, and access changes in a coordinated sequence.
• Agentic Reasoning: Agentic reasoning is the ability of a model to work through multi-step tasks that involve planning, state retention, and decision-making across tools or instructions. It is more operationally demanding than simple text generation because failures often appear as partial completion, wrong causality, or silent omission.

What's in the full article

SafeBreach's full article covers the data and operational detail this post intentionally leaves at the strategic level:

• The underlying benchmark results from Claude Mythos, GPT-5.5, and the UK AI Security Institute evaluations.
• The full comparison of GTIG, Mandiant, Rapid7, and Barracuda data sets on exploit timing and AI-assisted discovery.
• The SafeBreach interpretation of Adversarial Exposure Validation as a response to compressed exploit timelines.
• The wider discussion of frontier model governance, including what security leaders should measure instead of patch SLAs.

👉 SafeBreach's full article includes the benchmark data, incident examples, and analyst commentary behind this assessment.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and identity lifecycle control. It helps practitioners connect access governance to broader security resilience across modern identity programmes.