Topic starter
24/10/2026 8:47 pm
TL;DR: 2025 CVE volume reached 48,162 entries, and GreyNoise reports that generative AI helped push reported vulnerabilities up 130% from 2022 through 2025. Detection teams now have to map coverage, triage, and review faster without assuming their first pass is complete.
Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Enhanced Detection Engineering at Scale in the Agentic Era”.
By the numbers:
- The number of CVE entries added in 2025 reached 48,162, almost triple the 16,510 added in 2018.
- Reported CVEs grew 130% from 2022 through 2025.
- CVE Numbering Authorities grew from 23 in 2016 to over 500 by 2026.
Key questions
Q: Why does generative AI increase the pressure to automate security operations?
A: Generative AI can raise attack volume faster than teams can scale manually, while the cybersecurity workforce gap limits hiring.
Q: What are the signs that detection engineering is falling behind CVE volume?
A: Common signs include growing backlogs, delayed tag publication, repeated false positives, incomplete sensor coverage, and frequent rework after initial deployment.
Q: What breaks when CVE detection coverage is not in place fast enough?
A: The failure is not just missed alerts.
Practitioner guidance
- Build a CVE triage pipeline Automate intake of CVE summaries, references, PoCs, patch data, and operational context so analysts can prioritise by criticality and exploitability.
- Separate draft generation from approval Require human review of any agent-generated detection logic, including the evidence summary, before publishing tags or response rules.
- Measure telemetry coverage against high-risk platforms Compare your sensor estate with the software and hardware most likely to be targeted so gaps are explicit before exploitation starts.
Bottom line: Generative AI is widening the gap between CVE publication and usable detection coverage, which turns vulnerability response into a pipeline and governance problem.
Glossary terms: Cve Numbering Authority, Detection Coverage Gap, Deception Sensor, Agentic workflow
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Detection coverage has become a time-to-knowledge problem, not just a tooling problem. GreyNoise is describing a world where exploitation speed and vulnerability output both exceed human review capacity. That changes the governance question from whether detections exist to whether the organisation can produce and validate them before exposure becomes active. For identity and access teams, the lesson is that response windows are shrinking across the entire control stack, not only at the endpoint or perimeter.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern agent-generated detection content?
A: Treat agent output as a draft, not an authority. Teams should require provenance, confidence scoring, and explicit human approval for the final detection logic, especially when the agent has gathered references or drafted queries from mixed-quality sources. Governance should focus on traceability and reviewability, not on letting automation decide production change by itself.
👉 Read our full editorial: Agentic detection workflows aim to close CVE coverage gaps
This post was modified 6 days ago by NHI Mgmt Group