Topic starter
06/11/2026 6:38 pm
TL;DR: AI may lower the cost and skill needed to turn old vulnerabilities into working exploits, but raw CVE volume still says little about real exposure, according to Censys. Its data suggests the harder problem is not discovery, but whether organisations can actually patch what they run before exploitation follows.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “Thoughts on Vulnerability Response in the Era of the Vulnpocalypse and PHP2Shell”.
Key questions
A: Start with exposure validation, not enumeration.
Q: Why does patchability matter as much as vulnerability severity?
A: Patchability matters because exploitability depends on both the flaw and the ability to remove it.
Q: How should teams handle legacy software that cannot be updated quickly?
A: Teams should treat legacy software that cannot be updated quickly as a managed exception and contain it with network segmentation, application allowlisting, virtual patching and restricted privileged access.
Practitioner guidance
- Build a complete exposure inventory Track every internet-facing system, its version, its owner, and whether it can be patched, migrated, or isolated on demand.
- Create tested remediation paths for legacy platforms Document compatibility testing, rollback options, and hosting-provider dependencies for systems that cannot absorb emergency change safely.
- Prioritise exploitable weaknesses over raw CVE counts Rank vulnerabilities by reachable attack path, active exploitation evidence, and the value of the exposed asset rather than by volume alone.
Bottom line: AI-assisted exploit development matters because it shortens the time between disclosure and practical abuse, not because it makes every vulnerability catastrophic.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
AI is compressing the exploitation timeline, but it is not eliminating the defender’s real problem. The meaningful change is that flaws can move from disclosure to usable exploit much faster, especially when attackers can automate iteration. That makes exposure windows shorter and prioritisation harder, but it does not change the underlying governance burden: defenders still need asset visibility, ownership, and a way to change systems safely before exploitation starts.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to maintain an inventory of internet-facing systems?
A: The best way is to maintain a continuously updated asset record that ties each exposed system to an owner, location, internet-facing service and business purpose. Teams usually build it from discovery scans, cloud inventory, DNS and certificate data, then reconcile it against change records so new public systems are found, classified and tracked before they drift out of control.
👉 Read our full editorial: AI lowers exploit barriers, but patchability remains the real risk