Topic starter
11/11/2026 6:05 pm
TL;DR: CVE volume rose sharply while average time-to-exploit collapsed to before disclosure, according to ProjectDiscovery. Vulnerability programmes now need continuous discovery and triage because patch windows are no longer long enough to rely on periodic review.
Editorial analysis by NHI Mgmt Group, based on content published by ProjectDiscovery: “The Vulnerability Curve Bent With the AI Curve”.
By the numbers:
- In 2018 the world published about 18,000 CVEs, and by 2025 it was publishing nearly 50,000 a year.
Key questions
Q: Why does high CVE volume create more risk than a simple count suggests?
A: High CVE volume creates more risk than the count suggests because the real exposure comes from which assets are affected, whether exploits exist, and how quickly an attacker can reach them.
Q: How does zero-day exploitation change vulnerability management?
A: Zero-day exploitation turns vulnerability management into an active containment problem, because defenders cannot rely on published signatures, vendor guidance, or normal patch cycles.
Q: How should security teams respond when vulnerability discovery moves faster than manual triage?
A: They should move to risk-based automation that combines reachability, exploitability, and business context, then routes only the highest-priority issues into a governed remediation workflow.
Practitioner guidance
- Implement continuous exploitability triage Classify new disclosures by exposure, reachability and exploit confidence within hours, not in the next weekly review.
- Separate backlog from live risk Track open vulnerabilities as a rolling stock of exposure, with ageing, exploit status and asset criticality in one queue.
- Prioritise systems with identity-bearing services Give extra weight to vulnerable platforms that host service accounts, API keys, tokens or workload credentials, because compromise there expands blast radius.
Bottom line: The core problem is not just more vulnerabilities, but a shrinking or negative window in which defenders can respond before exploitation starts.
Glossary terms: CVE, Zero-day, Time-to-Exploit, Known Exploited Vulnerability
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Exploit speed has become the primary governance variable: vulnerability management is no longer about whether a bug exists, but whether defenders can act before the bug is weaponised. When median exploit timing moves to days and then before disclosure, the old assumption that patch cycles buy meaningful safety no longer holds. The practitioner conclusion is simple: exposure prioritisation must be continuous, not periodic.
A question worth separating out:
Q: What happens when exploit speed overtakes patch speed?
A: When exploit speed overtakes patch speed, vulnerabilities become usable by attackers before defenders can close them, so time-to-remediate is no longer the main control. Security teams need compensating measures such as network isolation, temporary service shutdown, attack surface reduction, web application filtering, and rapid configuration changes. The operational risk is persistent exposure even when patches are available.
👉 Read our full editorial: AI accelerates the exploit window faster than patch teams can close it