Topic starter
19/08/2026 4:06 pm
TL;DR: Agentic workflows can already autonomously exploit known vulnerabilities and chained exposure paths, while Google Mandiant says average time-to-exploit fell from 63 days in 2018 to 5 days in 2023, showing that CVE-led remediation now lags attacker tempo, according to CYCOGNITO. The practical shift is from patch queues to continuous outside-in exposure management that validates what is actually reachable and exploitable.
Editorial analysis by NHI Mgmt Group, based on content published by CYCOGNITO: “Mythos, MOAK, CTEM and the End of CVE Chasing”.
Key questions
Q: What breaks when security teams rely on CVE queues instead of exposure validation?
A: CVE queues break down when the attacker can exploit faster than the team can prioritise and patch.
Q: Why do agentic attacks make external reachability more important than severity scores?
A: Agentic attacks matter because automated workflows can test and chain weak points at machine speed, turning reachable exposure into compromise before human triage catches up.
Q: How do security teams know if an exposure programme is actually working?
A: Look for fewer verified attack paths, not just fewer alerts.
Practitioner guidance
- Validate external attackability continuously Measure which internet-facing services, APIs, and admin surfaces can actually be reached and exercised from the outside, then prioritise only the exposures that are demonstrably exploitable.
- Re-rank remediation by exploit path, not CVE score Combine vulnerability data with reachability, authentication state, and compensating controls so the highest-risk chain rises above low-value backlog noise.
- Inventory shadow services and stale exposures Find forgotten services, expired certificates, default credentials, and unmanaged interfaces that are invisible to ticket-driven remediation but visible to an attacker.
Bottom line: Agentic workflows can already compress reconnaissance, testing, and exploitation into a machine-speed sequence that outpaces backlog-based defence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:39 pm
CVE-led defence is becoming a control-plane illusion: the security programme appears ordered, but the attacker does not care about disclosure order, ticket order, or severity order. Once exploit windows shrink to hours, backlog management stops being a defensible security boundary and becomes an administrative process. The practitioner conclusion is that risk has to be governed by reachability and exploitability, not disclosure volume.
A question worth separating out:
Q: What should organisations do when exposed assets can be chained into compromise?
A: They should treat the chain as the unit of risk and remove the weakest link that enables progression from discovery to access. That means closing unauthenticated interfaces, fixing misconfigurations, and removing stale or forgotten exposure before the chain is completed.
👉 Read our full editorial: Agentic AI is outpacing CVE-led defence and exposure management