Notifications
Clear all
Topic starter
02/08/2026 11:46 am
TL;DR: Anthropic’s Mythos model autonomously found long-standing flaws in OpenBSD and FFmpeg, while XM Cyber argues the bigger issue is that critical exposures often sit outside CVE-led workflows and exploit the human, identity, and trust layers instead of the codebase. The board conversation now has to move from patch counts to reachable attack paths, over-privileged AI integrations, and business impact.
NHIMG editorial — based on content published by XM Cyber: AI model findings and the changing exposure management conversation
By the numbers:
- Only 1% of 2025 CVEs were exploited in the wild.
- Gartner projected over one million CVEs by 2030.
Questions worth separating out
Q: What breaks when AI and identity controls are not aligned in exposure management?
A: When AI permissions, service identities, and exposure workflows are managed separately, organisations miss the paths attackers actually use.
Q: Why do over-privileged AI integrations increase enterprise exposure risk?
A: Because access rights determine what an AI system can change, read, or trigger after authentication.
Q: What should teams measure to know whether exposure management is working?
A: Track time to containment, secret revocation latency, and the percentage of high-risk systems covered by explicit ownership.
Practitioner guidance
- Map attack paths to critical assets Build exposure reporting around the systems attackers can actually reach, then weight findings by business impact and exploitability instead of CVSS alone.
- Inventory AI and machine permissions Document every AI tool, service account, token, and integration that can write, execute, or access sensitive data.
- Tie supply-chain risk to identity assurance Require stronger approval, signing, and access review for developers, maintainers, and build pipelines that can release software or models into production.
What's in the full article
XM Cyber's full article covers the operational detail this post intentionally leaves for the source:
- How the Glasswing argument maps to exposure management workflows and board reporting.
- The specific AI and software-supply-chain examples the article uses to show why CVEs are incomplete.
- The author’s breakdown of how human compromise and misconfigured identities shape real attack paths.
- Why the article believes continuous exposure management is the better control model for this risk.
👉 Read XM Cyber's analysis of AI-assisted vulnerability discovery and exposure management →
AI model findings and the exposure management gap boards miss?
Explore further
02/08/2026 12:57 pm
Exposure management has outgrown CVE management. The article is right to challenge the assumption that finding more vulnerabilities equals better security. Organisations are increasingly breached through reachable identities, exposed trust chains, and over-permissioned integrations that never appear in a scan result. That means exposure management must join code, identity, and runtime context into one decision model, not a separate queue. Practitioners should treat exploitability and privilege scope as the real security variables.
A question worth separating out:
Q: Who is accountable when a misconfigured AI integration or trusted update path is exploited?
A: Accountability should sit with the control owners for identity, application delivery, and risk governance, not only with vulnerability management. If the path involved privileged credentials, build pipelines, or an AI integration, those owners must be part of the remediation and assurance model because the failure crossed multiple domains.
👉 Read our full editorial: AI model findings expose why exposure management now exceeds CVEs
