Notifications
Clear all
Topic starter
18/08/2026 2:26 pm
TL;DR: AI-powered offensive tooling is not creating a new vulnerability crisis, according to OFFENSAI, but it is exposing how many security programmes still cannot distinguish exploitable risk from background noise. The real issue is validation at scale, because only around 2% of discovered vulnerabilities are ever exploited in the wild.
NHIMG editorial — based on content published by OFFENSAI: Security The Vulnpocalypse Isn’t Coming. It’s Already Here
By the numbers:
- Only around 2% of discovered vulnerabilities are ever exploited in the wild.
Questions worth separating out
Q: How should security teams prioritise vulnerabilities when AI speeds up attack discovery?
A: They should prioritise by exploitable context, not by severity alone.
Q: Why do identity and NHI sprawl make vulnerability management harder?
A: Because many modern exploit paths depend on access, not just code flaws.
Q: What signals show that a vulnerability programme is measuring the wrong thing?
A: If teams can report thousands of findings but cannot demonstrate which ones are reachable, chained, or blocked by effective controls, they are measuring noise rather than risk.
Practitioner guidance
- Validate exploitability continuously Use attacker-path testing to confirm whether discovered weaknesses are actually reachable in your environment, then prioritise remediation based on chained impact rather than scanner severity alone.
- Map identity-driven attack paths Trace how service accounts, API keys, tokens, and delegated permissions could connect a vulnerability to lateral movement or data access, especially in cloud and AI integrations.
- Reduce attack surface before expanding AI workflows Require identity review, permission scoping, and control verification before new AI-enabled integrations are approved, so added speed does not outpace governance.
What's in the full article
OFFENSAI's full analysis covers the operational detail this post intentionally leaves for the source:
- How the article frames AI-powered offensive security agents against existing vulnerability management workflows
- The specific logic behind the claim that only a small fraction of discovered weaknesses are actually exploitable
- The article's discussion of attack-surface growth, validation limits, and why more dashboards do not solve the problem
- The full reasoning behind continuous security validation as a practical response to AI-accelerated testing
👉 Read OFFENSAI's analysis of why AI is exposing a deeper vulnerability validation gap →
Vulnerability validation is the real gap. Are your controls keeping up?
Explore further
18/08/2026 3:16 pm
AI is amplifying exposure discovery, not creating a new vulnerability economy. The article correctly rejects the idea of a vulnpocalypse as a new threat class. What changes is the speed at which existing weaknesses are surfaced and tested, which means programmes that already lacked control fidelity will feel overwhelmed first. The practical conclusion is that AI is a force multiplier for governance weakness, not a substitute for it.
A question worth separating out:
Q: How can organisations respond when AI shortens the time between discovery and exploitation?
A: They should compress their own decision cycle by moving to continuous validation, smaller trust zones, and faster identity remediation. The goal is to prove whether a control works before an attacker does, especially where machine identities and delegated access expand the blast radius.
👉 Read our full editorial: AI exposes a deeper vulnerability validation gap in security programs
