AI-driven vulnerability growth: what matters more than severity scores?

TL;DR: AI-assisted discovery is accelerating vulnerability volume, with 21,667 vulnerabilities tracked in the first half of 2026, 20% carrying public exploit code and some weaponized within 24 hours, which makes static severity scoring insufficient for prioritisation, according to Flashpoint. Risk now depends on exploitability, exposure, business context and remediation speed, not disclosure volume alone.

Editorial analysis by NHI Mgmt Group, based on content published by Flashpoint: “The Flashpoint Method For Threat-Informed Vulnerability Prioritization”.

By the numbers:

• Nearly one-fifth, or 20%, of all vulnerabilities disclosed had publicly available exploit code.
• Some vulnerabilities are weaponized in as little as 24 hours after disclosure.
• Flashpoint’s Known Exploited Vulnerabilities list recently surpassed 7,000 entries, around 800 of which lack a CVE ID.

Key questions

Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?

A: They should prioritise by exploitable context, not by severity alone.

Q: What breaks when vulnerability management is based only on CVSS scores?

A: CVSS-only prioritisation breaks when several lower-scoring flaws can be combined into a complete exploit path.

Q: What are the signs that OT vulnerability triage is failing?

A: Common signs include long lists of critical findings with no remediation order, repeated arguments between security and operations, and tickets that omit asset role or production impact.

Practitioner guidance

• Build a threat-informed triage model Score vulnerabilities using exploit availability, active exploitation, asset exposure, business criticality and remediation cost rather than severity alone.
• Map vulnerable assets to business services Tag internet-facing systems, privileged workflows and identity-dependent services so triage can reflect blast radius instead of scanner volume.
• Track exploitation signals as first-class inputs Treat KEV inclusion, public exploit code, zero-day status and threat chatter as operational triggers for escalation.

Bottom line: AI-assisted discovery increases vulnerability volume, but that alone does not tell security teams which flaws are most dangerous in context.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →