Notifications
Clear all
Topic starter
01/08/2026 10:48 pm
TL;DR: AI systems can now reason about applications, chain vulnerabilities, and produce working exploits within hours of disclosure, according to Tenzai’s June 25, 2026 research. The practical shift is from periodic scanning to continuous adversarial testing, because static patch-and-repeat programmes no longer keep pace with attacker iteration.
NHIMG editorial — based on content published by Tenzai: Mythos Preview, what every CISO should do now
By the numbers:
- On April 7, 2026, Anthropic's Project Glasswing demonstrated that AI models can now autonomously discover and exploit vulnerabilities at scale across major operating systems and browsers with no human guidance.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
A: They should shift from point-in-time vulnerability handling to continuous exposure reduction.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: What breaks when organisations rely only on quarterly patching and traditional scans?
A: They lose the timing advantage.
Practitioner guidance
- Pre-authorise rapid remediation budgets Create a dedicated security budget with a fast-track approval path so emergency testing, tooling, and patch work do not wait for repeated sign-off.
- Build continuous attack-path validation Run AI-assisted offensive testing against internet-facing applications and critical services continuously, with a focus on chaining findings rather than just detecting them.
- Inventory exposed credentials and service accounts Maintain a live inventory of API keys, service accounts, tokens, certificates, and third-party dependencies so you can prioritise the assets most likely to become initial access points.
What's in the full article
Tenzai's full research covers the operational detail this post intentionally leaves for the source:
- Sequenced CISO to-do list with the budget, procurement, inventory, testing, patching, and war room steps in the order Tenzai recommends.
- Detailed guidance on running AI-assisted application testing and LLM-based code review as separate defensive layers.
- Practical examples of fast-track patch workflows for open source libraries, first-party code, and internet-facing systems.
- The source article’s view on vendor escalation, communication protocols, and response readiness under a Log4j-style event.
👉 Read Tenzai's guide to AI-driven attacker speed and CISO response →
AI-driven exploitation speed is breaking patch-and-scan models?
Explore further
01/08/2026 10:56 pm
Adaptive exploitation has made patch cadence a governance problem, not just an operations problem. The article describes a world where attacks iterate faster than quarterly review cycles and even faster than many emergency change processes. That means the control gap is no longer missing awareness, but the assumption that defenders can respond on a human timetable. Practitioners should treat exploitability as a live governance metric, not a retrospective one.
A question worth separating out:
Q: Who is accountable when AI-assisted exploitation reaches production before remediation?
A: Accountability sits with the programme owners who control patch prioritisation, identity governance, and incident response readiness. In practice that means security leadership, infrastructure owners, and application teams share responsibility for closing exposure quickly, while governance teams should track response time as a measurable control outcome.
👉 Read our full editorial: AI-driven attackers are collapsing exploit timelines across enterprises
