Topic starter
02/08/2026 11:37 am
TL;DR: 840 days to 1.6 days shows how quickly exploit timelines have compressed, in Checkmarx case work on AI-generated exploits. Severity labels lose value when weaponisation can happen before manual review closes the gap.
Editorial analysis by NHI Mgmt Group, based on content published by Checkmarx: “Two Fronts, One Risk: Securing Yesterday’s Debt and Today’s AI Code”.
By the numbers:
- The average time to exploit a disclosed vulnerability fell from 840 days in 2018 to 1.6 days by 2026.
- Security researchers project exploit timelines will reach one minute by 2028.
- Checkmarx says 81% of companies knowingly ship vulnerable code because backlogs are growing faster than teams can manually remediate.
Key questions
Q: Why do AI-assisted vulnerability discoveries change remediation priorities?
A: Because they shorten the time between disclosure and exploitation.
Q: How do security leaders know if a testing and remediation program is actually working?
A: Security leaders should look for improved attacker resistance, not just fewer findings.
Q: What fails when teams keep using severity-based triage for AI-era vulnerabilities?
A: Severity-based triage fails because it assumes exploitation takes time, skill, and effort.
Practitioner guidance
- Reprioritise backlog items by exploitability Move away from severity-first queues and rank unresolved findings by reachability, production exposure, and confirmed exploitability.
- Automate closure for confirmed findings Use agentic remediation to patch validated issues at the pull request stage, with human review reserved for exceptions and high-risk changes.
- Govern AI coding tools as credentialed systems Inventory AI assistants, MCP servers, and coding agents alongside their secrets, tokens, and access scopes so they are controlled like other non-human identities.
Bottom line: AI-assisted exploit generation has reduced the usefulness of severity-first triage because even low-rated vulnerabilities can now be weaponised quickly.
Glossary terms: Attackability, Exploitability context, Agentic remediation, AI supply chain
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:50 pm
Attackability, not severity, is now the governing variable: once exploit generation becomes cheap and fast, a vulnerability’s label tells you less than whether it is reachable in production. That means remediation policy has to be tied to live exploitability rather than inherited scores. Practitioners should treat backlog triage as a control decision about exposure, not an administrative queue.
A question worth separating out:
Q: What should teams do when AI coding tools are part of the software supply chain?
A: Treat the tools, agents, and connectors as governed machine identities. That means inventorying their secrets, limiting delegated access, and checking whether tampering, malicious packages, or unsafe prompts can influence code generation or deployment decisions.
👉 Read our full editorial: AI-generated exploits collapse vulnerability response windows