Notifications
Clear all
Topic starter
02/08/2026 11:37 am
TL;DR: AI models can now generate working exploits in minutes for under a dollar, while benchmarked exploit success and detection rates show offensive capability is advancing faster than defensive review cycles, according to Checkmarx. The implication is that severity-based triage is no longer enough, and security teams need continuous attackability-led remediation and prevention at the point of code creation.
NHIMG editorial — based on content published by Checkmarx: AI-speed vulnerability remediation and the case for prevention at inception
By the numbers:
- In 2018, it took an attacker an average of 840 days to exploit a disclosed vulnerability, but by 2026 that number had collapsed to 1.6 days.
- 81% of companies knowingly ship vulnerable code because backlogs are growing faster than teams can manually remediate.
Questions worth separating out
Q: What breaks when organisations still rely on severity-only vulnerability management?
A: They fix the wrong things first.
Q: Why do access sprawl and AI workflows create more identity risk?
A: Because they multiply the number of places where credentials, approvals, and delegated actions can occur without clear ownership.
Q: How do security teams know whether vulnerability assessment is actually working?
A: Teams should look for short triage cycles, high-confidence findings, and a clear link between scan results and remediation action.
Practitioner guidance
- Prioritise reachable vulnerabilities first Re-rank findings by exploitability in production, not only by CVSS score.
- Automate closure of confirmed exposures Use agentic remediation for validated findings so teams are not waiting on manual tickets for every exploitable issue.
- Move security into the coding workflow Add real-time scanning at the IDE, pull request, and CI/CD stages so insecure code is intercepted before merge.
What's in the full article
Checkmarx's full analysis covers the operational detail this post intentionally leaves for the source:
- Attackability scoring and fidelity funnel details for separating confirmed risk from raw findings
- Agentic remediation workflow examples showing how fixes can be applied at the pull request level
- AI supply chain coverage for MCP servers, AI agents, and model-integrated development tooling
- Benchmark data on detection, false positives, and remediation time that supports implementation planning
👉 Read Checkmarx's analysis of AI-speed vulnerability remediation and AI supply chain risk →
AI-generated exploits and the remediation gap teams are missing?
Explore further
02/08/2026 12:50 pm
AI-speed exploitation has turned vulnerability backlogs into exposure inventories. The old model treated unresolved findings as deferred work, but AI-generated exploit chains collapse the time between disclosure and abuse. That changes the governance question from backlog volume to exposure window. For identity teams, the same logic applies to service accounts, API keys, and automation tokens that remain valid long after the risk score was assigned. Practitioner conclusion: treat unresolved reachability as active access risk, not future maintenance.
A question worth separating out:
Q: Should organisations treat AI coding assistants as part of the security boundary?
A: Yes. If an AI assistant can generate code, open pull requests, or influence deployment, it is operating inside the security boundary and must be governed accordingly. That means controlling its connectors, monitoring its outputs, and limiting the credentials it can access.
👉 Read our full editorial: AI-generated exploits collapse vulnerability response windows
