Notifications
Clear all
Topic starter
14/08/2026 6:33 pm
TL;DR: Vulnerability exploitation now accounts for 32% of initial infections in Mandiant’s 2026 M-Trends report and 31% of breaches in Verizon’s 2026 DBIR, while AI-driven attacks add an average of $1 million to breach costs, according to IBM. Patch-first programmes are losing to machine-speed discovery, making containment and blast-radius reduction the decisive control layer.
NHIMG editorial — based on content published by Zero Networks: Vulnerability Management in the Frontier AI Era: How to Proactively Stop Exploitation
By the numbers:
- Vulnerability exploitation accounts for 32% of initial infections in Mandiant’s 2026 M-Trends report.
- AI-driven attacks add an average of $1 million to the cost of a breach, according to IBM’s 2026 Cost of a Data Breach report.
- Only 26% of vulnerabilities defined as critical in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38% the year prior.
Questions worth separating out
Q: How should security teams handle critical vulnerabilities when patching cannot happen right away?
A: Teams should treat the vulnerability as a live production exposure and decide whether a runtime compensating control can contain exploitation until patching is possible.
Q: Why do AI-driven exploit tools change the way teams should prioritise risk?
A: They change risk priority because exploitability is no longer constrained by time, cost, or specialist effort.
Q: What breaks when vulnerability management is based only on CVSS scores?
A: CVSS-only prioritisation breaks when several lower-scoring flaws can be combined into a complete exploit path.
Practitioner guidance
- Measure blast radius before remediation windows Map what each vulnerable asset can reach, which identities can traverse those paths, and where a single foothold would create disproportionate business exposure.
- Close unnecessary internal access paths by default Use identity-based microsegmentation to remove convenience routes, especially between user zones, admin networks, service tiers, and workload segments.
- Pair patching with compensating containment rules When a patch is delayed or operationally risky, enforce a targeted rule that blocks the specific traffic or path the vulnerability depends on until remediation can be safely deployed.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- A practical explanation of identity-based microsegmentation as a containment layer for vulnerable assets.
- Examples of how to prioritise remediation using blast radius and internal reachability instead of severity alone.
- Operational guidance on buying time to patch safely when fixes are risky or unavailable.
- How Zero Networks frames the move from reactive patching to closed-by-default architecture.
👉 Read Zero Networks’ analysis of frontier AI and vulnerability exploitation →
Frontier AI and vulnerability exploitation: what security teams should do?
Explore further
14/08/2026 6:38 pm
Patch velocity is no longer the control that defines resilience. The article reflects a broader shift in which exploitation speed has outgrown the governance model built around scheduled remediation. Once discovery collapses into near-immediate weaponisation, the deciding variable becomes whether the environment still permits movement after compromise. Practitioners should read this as a signal that blast-radius control has become a primary security objective.
A question worth separating out:
Q: Which control should teams use when a critical patch could disrupt production?
A: Use a compensating containment control that blocks the vulnerable path until the fix can be tested and deployed safely. In practice, that means temporary network or identity-based restrictions that narrow access without waiting for full remediation.
👉 Read our full editorial: Frontier AI is collapsing vulnerability exploitation windows
