Topic starter
01/08/2026 8:54 pm
TL;DR: AI is compressing the time between exposure and exploitation, and Horizons.ai says only 30% of CISOs routinely validate remediation after patching while nearly half still rely on rescans. The readiness problem is no longer deployment volume, but whether controls still interrupt real attack paths under adversarial pressure.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “The New Measure of Infrastructure Readiness”.
By the numbers:
- Only 30% of CISOs say their organizations routinely validate that risk has actually been remediated after patching.
Key questions
Q: How should teams prove that remediation actually reduced risk?
A: They should re-run the exposure test after the fix or mitigation, then compare the pre-change and post-change results for reachability, blocking, and alerting.
Q: Why do AI-accelerated attacks expose weaknesses in control-by-control security programmes?
A: Because attackers chain small gaps across identity, cloud, endpoint, and network layers faster than periodic assessments can keep up.
Q: What are the signs that infrastructure controls are giving false confidence?
A: The clearest sign is when teams can report patching, scanning, and control deployment but cannot show whether those changes stopped an attacker from progressing.
Practitioner guidance
- Validate remediation, not just vulnerability removal Replace post-patch rescans as the primary proof signal with testing that shows whether the exposure can still be used in an attack path.
- Exercise cross-domain attack paths Test whether compromise in one layer can still become privilege, lateral movement, or business impact across identity, cloud, and endpoint boundaries.
- Prioritise controls that interrupt movement Focus remediation on the handoffs where identities, segmentation, and trusted connections allow attackers to cross from one control domain into another.
Bottom line: AI is shortening the time between exposure and exploitation, which makes traditional assurance cycles too slow to prove resilience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:02 pm
Proof of resilience is becoming the real security control. The article captures a shift that identity and infrastructure teams both need to absorb: deployment no longer equals protection. If an AI-enabled attacker can move faster than review cycles, then the meaningful question is whether the architecture can interrupt a live attack path, not whether it has been documented as secure. Practitioners should treat proof as an operating requirement, not an audit afterthought.
A question worth separating out:
Q: Should organisations prioritise continuous validation over adding more tools?
A: Yes, when the main problem is uncertainty about what existing controls really stop. Adding tools can expand coverage, but it does not close the proof gap unless the new control is also tested against the techniques that matter. The better sequence is to validate, improve, and only then decide whether a new tool is actually needed.
👉 Read our full editorial: Infrastructure readiness now depends on proof, not deployed controls