Topic starter
02/08/2026 11:37 am
TL;DR: AI models can now generate working exploits in minutes for under a dollar, while benchmarked exploit success and detection rates show offensive capability is advancing faster than defensive review cycles, according to Checkmarx. The implication is that severity-based triage is no longer enough, and security teams need continuous attackability-led remediation and prevention at the point of code creation.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Two Fronts, One Risk: Securing Yesterday’s Debt and Today’s AI Code”.
By the numbers:
- The average time to exploit a disclosed vulnerability fell from 840 days in 2018 to 1.6 days by 2026.
- Security researchers project exploit timelines will reach one minute by 2028.
- Checkmarx says 81% of companies knowingly ship vulnerable code because backlogs are growing faster than teams can manually remediate.
Key questions
Q: What fails when teams keep using severity-based triage for AI-era vulnerabilities?
A: Severity-based triage fails because it assumes exploitation takes time, skill, and effort.
Q: Why do AI-assisted vulnerability discoveries change remediation priorities?
A: Because they shorten the time between disclosure and exploitation.
Q: How do security leaders know if a testing and remediation program is actually working?
A: Security leaders should look for improved attacker resistance, not just fewer findings.
Practitioner guidance
- Reprioritise backlog items by exploitability Move away from severity-first queues and rank unresolved findings by reachability, production exposure, and confirmed exploitability.
- Automate closure for confirmed findings Use agentic remediation to patch validated issues at the pull request stage, with human review reserved for exceptions and high-risk changes.
- Govern AI coding tools as credentialed systems Inventory AI assistants, MCP servers, and coding agents alongside their secrets, tokens, and access scopes so they are controlled like other non-human identities.
Bottom line: AI-assisted exploit generation has reduced the usefulness of severity-first triage because even low-rated vulnerabilities can now be weaponised quickly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:50 pm
Attackability, not severity, is now the governing variable: once exploit generation becomes cheap and fast, a vulnerability’s label tells you less than whether it is reachable in production. That means remediation policy has to be tied to live exploitability rather than inherited scores. Practitioners should treat backlog triage as a control decision about exposure, not an administrative queue.
A question worth separating out:
Q: What should teams do when AI coding tools are part of the software supply chain?
A: Treat the tools, agents, and connectors as governed machine identities. That means inventorying their secrets, limiting delegated access, and checking whether tampering, malicious packages, or unsafe prompts can influence code generation or deployment decisions.
👉 Read our full editorial: AI-generated exploits collapse vulnerability response windows