AI-driven vulnerability volume: what does prioritisation need now?

TL;DR: AI-assisted discovery is increasing vulnerability volume and compressing the time between disclosure and exploitation, with Flashpoint tracking 21,667 vulnerabilities in H1 2026 and one-in-five containing public exploit code at disclosure. Static severity scoring is no longer enough when remediation must account for exploitability, asset exposure, and business impact.

Editorial analysis by NHI Mgmt Group, based on content published by Flashpoint: “The Flashpoint Method: Prioritizing Vulnerabilities in an Era of AI-Accelerated Discovery”.

By the numbers:

• Some vulnerabilities were weaponized in as little as 24 hours after disclosure, according to Flashpoint.

Key questions

Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?

A: They should prioritise by exploitable context, not by severity alone.

Q: Why isn't CVSS enough for deciding what to fix first?

A: CVSS measures technical severity, but it does not tell you whether exploit code exists, whether the asset is exposed, or whether the weakness sits on a path to sensitive systems.

Q: What happens when exploit code is public before teams finish triage?

A: The remediation queue becomes a race against attacker timing.

Practitioner guidance

• Build a threat-informed scoring model Weight active exploitation, public exploit code, asset exposure, business criticality, and remediation effort before assigning queue priority.
• Separate discovery from prioritisation Treat AI-assisted findings as an intake stream, then triage them through explicit criteria so volume does not become the default decision maker.
• Shorten response paths for zero-day-like conditions Escalate vulnerabilities with public exploit code or rapid weaponization into an accelerated review lane with pre-approved remediation options.

Bottom line: AI-assisted discovery increases the number of vulnerabilities teams must evaluate, but it does not reduce the need to judge which ones are exploitable and business-relevant.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →