Topic starter
19/08/2026 3:42 pm
TL;DR: With over 48,000 CVEs published in 2025 and attackers exploiting them in about 20 hours, Seemplicity argues that vulnerability management now needs AI-driven prioritisation, continuous discovery, and attack-path analysis because scan volume alone no longer reflects real risk. The deciding control is not patch throughput but the ability to reduce exposure paths before adversaries traverse them.
Editorial analysis by NHI Mgmt Group, based on content published by Seemplicity: “How to Use AI for Vulnerability Management”.
By the numbers:
- In 2025, over 48,000 CVEs were published, which is roughly 130 new vulnerabilities every single day.
- The average time from CVE disclosure to active exploitation is now just 20 hours.
Key questions
Q: What breaks when vulnerability management is limited to scan results?
A: Teams end up triaging large numbers of findings without knowing which ones can be chained into a working attack.
Q: Why does attack-path prioritisation reduce risk better than CVSS ranking?
A: CVSS describes technical severity, but it does not tell you whether a weakness sits on a reachable route to a critical asset.
Q: What are the signs that vulnerability management is not working well enough in an enterprise?
A: Common warning signs include long remediation cycles, weak visibility into where vulnerabilities exist, and inconsistent prioritisation of high-risk findings.
Practitioner guidance
- Consolidate exposure data across tools Normalize findings from scanners, cloud platforms, code repositories, and runtime telemetry into a single exposure model so path analysis has complete inputs.
- Prioritise attack paths, not vulnerability lists Rank remediation by routes to crown-jewel assets, taking privilege, network reachability, and business criticality into account instead of severity alone.
- Add continuous discovery for ephemeral assets Track containers, serverless functions, and temporary environments continuously so short-lived resources are not absent from the risk model between scans.
Bottom line: Traditional vulnerability management is failing because it counts findings while attackers target traversable paths to critical assets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:20 pm
Attack-path control is the real governance shift: vulnerability management is no longer a count-and-close exercise, because the issue is not how many CVEs exist but which ones sit on a traversable route to critical assets. In modern environments, exposure is relational, not isolated, so the security model has to understand adjacency, privilege, and reachability. That is the governance gap the article identifies, and it is the gap defenders must close.
A question worth separating out:
Q: How should teams govern AI-generated vulnerabilities before they reach production?
A: Start by treating AI-assisted development as a governed change path rather than a convenience layer. Require inventory, ownership, review thresholds, and exception handling for every AI-enabled workflow so vulnerable output is caught before release rather than triaged after exposure has already accumulated.
👉 Read our full editorial: AI-driven vulnerability management needs attack-path control, not more scans