AI speeds up exploit development, exposing limits of CVE-based security

Security teams urged to shift focus from vulnerability counts to real-world risk

edit

By LineZotpaper

Published4 October 2026

Read Time2 min

Artificial intelligence is accelerating the speed at which software vulnerabilities are discovered and exploited, and security experts say the traditional model of vulnerability management, built on CVE lists and severity scores, can no longer keep up. An analysis published by The New Stack argues organizations must move from counting vulnerabilities to assessing which ones pose meaningful risk in their own environments.

Cybersecurity teams are being urged to rethink how they manage software vulnerabilities as AI compresses the time between a flaw being disclosed and it being exploited.

The traditional model has changed little for years: scan software, identify CVEs, assign severity scores, prioritize findings and send them to developers. The New Stack analysis argues that approach never perfectly reflected risk, and AI has made its limits impossible to ignore.

The amount of software being produced is expanding rapidly, vulnerability discovery is accelerating, and the time required to develop exploits is shrinking. AI-enabled attacks can also chain vulnerabilities together in ways that are difficult to anticipate manually. The result is a widening gap between the vulnerabilities teams can identify and the ones they can meaningfully investigate and remediate.

The article argues the question should change from "How many CVEs do we have?" to "Which vulnerabilities create meaningful risk in our environment?" A CVE confirms a vulnerability exists, but not how likely it is to be exploited against a particular organization. CVSS scores describe technical severity and potential impact, but not whether an exploit exists, is being used in the wild, or whether the vulnerable component is exposed in a given environment.

Two organizations can carry the same CVE and face very different risk. One may have the component behind multiple layers of protection; another may run it in an internet-facing production application. As the article puts it: "The CVE is identical. The risk is not."

Programs built around static severity scores can produce misleading progress. The piece calls this "CVE theater": measuring activity rather than meaningful risk reduction.

AI is changing the economics of exploitation on both sides. More code means more exposure even if vulnerability density declines, and much modern software depends on open-source components. Attackers can automate tasks that previously required manual effort. The combination of more vulnerabilities and a collapsing time-to-exploit window creates a fundamentally different security environment.

Analysis

Why This Matters

Security teams face a widening gap between the volume of disclosed vulnerabilities and the capacity to remediate them, making it harder to know where to focus limited resources.
As AI lowers the cost of developing exploits, organizations that measure success by vulnerability counts may discover their real exposure has not fallen.
The shift from severity to risk-based prioritization could reshape how security tools are bought, built and measured.

Background

Vulnerability management has long relied on CVE identifiers and CVSS scores to rank what to fix first. These systems describe technical severity but were never designed to answer whether a particular flaw is exploitable in a particular environment. AI is now accelerating both the production of software and the automation available to attackers, increasing pressure on the old model.

Key Perspectives

Security teams and risk officers: A risk-based approach focuses limited remediation resources on vulnerabilities that actually threaten the organization, rather than chasing the longest CVE list. Advocates of the existing model: Severity scoring provides a consistent, scalable baseline for triage, and organizations without it could struggle to prioritize at all. Critics and skeptics: Shifting to risk-based prioritization requires detailed knowledge of every environment, which many organizations lack. There are concerns it could introduce new complexity or that risk models themselves could be gamed.

What to Watch

Whether security teams begin publicly reporting reductions in meaningful risk rather than CVE closure counts.
Adoption of tools that bring environment-specific context, such as exposure and exploitability data, into vulnerability prioritization.
Evidence of AI-assisted attacks chaining multiple vulnerabilities, which would accelerate the shift described in the source.

Sources

AI is speeding up exploits. Vulnerability spreadsheets can’t keep up. — The New Stack