Agentic detection engineering: can it keep pace with CVE volume?

TL;DR: Generative AI has helped drive 2025 CVE growth to 48,162 entries, with reported vulnerabilities rising 130% from 2022 through 2025 and mean time to exploit now slightly negative, according to GreyNoise. That shift turns detection coverage into a governance problem: teams must automate triage and review without losing precision or introducing false confidence.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Enhanced Detection Engineering at Scale in the Agentic Era”.

By the numbers:

• The number of CVE entries added in 2025 reached 48,162, almost triple the 16,510 added in 2018.
• Reported CVEs grew 130% from 2022 through 2025.
• CVE Numbering Authorities grew from 23 in 2016 to over 500 by 2026.

Key questions

Q: What breaks when CVE detection coverage is not in place fast enough?

A: The failure is not just missed alerts.

Q: Why does generative AI increase the pressure to automate security operations?

A: Generative AI can raise attack volume faster than teams can scale manually, while the cybersecurity workforce gap limits hiring.

Q: What are the signs that detection engineering is falling behind CVE volume?

A: Common signs include growing backlogs, delayed tag publication, repeated false positives, incomplete sensor coverage, and frequent rework after initial deployment.

Practitioner guidance

• Build a CVE triage pipeline Automate intake of CVE summaries, references, PoCs, patch data, and operational context so analysts can prioritise by criticality and exploitability.
• Separate draft generation from approval Require human review of any agent-generated detection logic, including the evidence summary, before publishing tags or response rules.
• Measure telemetry coverage against high-risk platforms Compare your sensor estate with the software and hardware most likely to be targeted so gaps are explicit before exploitation starts.

Bottom line: Generative AI is widening the gap between CVE publication and usable detection coverage, which turns vulnerability response into a pipeline and governance problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →