Attackers now exploit many vulnerabilities before a patch is available, and new CVEs arrive faster than any team can fix them. Sorting that backlog by CVSS score sends scarce patching time to the wrong places. The better approach is to add a validation step: use exposure validation and breach and attack simulation (BAS) to prove which weaknesses are reachable, exploitable, and unstopped in your environment, then fix those first.
The patch window is gone
Mandiant has measured time to exploit, the gap between disclosure and first observed exploitation, for years. It averaged 63 days in 2018 and 2019, 32 days across 2021 and 2022, and five days in 2023. M-Trends 2026 puts the estimated mean at negative seven days, so exploitation routinely begins before a fix ships. VulnCheck found that 23.43% of the exploited vulnerabilities it tracked in the first half of 2026 were attacked on or before the day their CVE was published.
Exploitation is also now the most common way in. The 2026 Verizon DBIR says 31% of breaches start with a software vulnerability, the first year it has beaten stolen credentials. Mandiant’s own casework shows exploits behind 32% of intrusions, the leading initial vector for the sixth year running.
AI raises the pressure on both sides. In an Anthropic benchmark against Firefox’s JavaScript engine, Claude Mythos Preview built working exploits 181 times, while Claude Opus 4.6 managed two in several hundred tries. By May 22, 2026, Anthropic and about 50 Project Glasswing partners had used the model to find more than 10,000 high or critical vulnerabilities. Fixing is the slow half: Anthropic’s disclosure dashboard showed 2,300 flaws reported to open source maintainers and 421 known patched as of August 26, 2026.
Keep the hype in proportion, though. VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery and found only 14 confirmed as exploited in the wild. And when Amazon tracked an AI-assisted actor who compromised more than 600 FortiGate devices in early 2026, no FortiGate vulnerability was used. The way in was exposed management ports and weak single-factor passwords. The actor’s own notes logged failure wherever services were patched, ports were closed, or a CVE did not apply to the target’s OS. AI helps attackers scale against whatever is reachable and weak. That is exactly what your prioritization should measure.
Why CVSS-first vulnerability management falls behind
Volume alone breaks the old model. Jerry Gamblin’s 2025 review counts 48,185 CVEs published last year, up 20.6%, with 18,987 of them rated high or critical. Over the same year, CISA added 245 entries to its Known Exploited Vulnerabilities (KEV) catalog. That works out to about one KEV addition for every 77 new high or critical CVEs. A queue sorted by severity puts thousands of findings ahead of the few that attackers actually use.
The scores are also getting harder to come by. In April 2026 NIST reported that CVE submissions grew 263% between 2020 and 2025 and said the NVD would focus enrichment on KEV entries, software the federal government uses, and software deemed critical under Executive Order 14028. Everything else goes to the lowest priority, and NIST no longer routinely adds its own severity score when the issuing authority already provided one.
Remediation is getting slower at the same time. Verizon found only 26% of KEV-listed flaws fully fixed across the organizations it studied, down from 38%, and a median of 43 days to patch, up from 32, as reported by Help Net Security.
The core issue is that CVSS rates a flaw in the abstract. A 9.8 on an isolated lab server can matter far less than a 7.5 on the VPN gateway every employee uses, and the score has no input that tells them apart. Reachability, compensating controls, and asset value live in your environment, not in the CVE record. CISA now says much the same to federal agencies. BOD 26-04, issued June 10, 2026, revoked BOD 22-01 and sets deadlines from four questions: is the asset publicly exposed, is the flaw in KEV, can exploitation be automated, and does it give partial or total control. Deadlines run from three days plus forensic triage down to “fix on system upgrade.” The directive’s background notes that attackers’ use of AI may further shrink the time defenders have after a patch is released.
What breach and attack simulation adds
Exposure validation means producing evidence that an attack would or would not work against you, instead of inferring it from a score. Gartner’s continuous threat exposure management (CTEM) model treats validation as its own stage between prioritization and mobilization, and lists BAS as one way to do it. Vendors in this market say budgets are following; Picus made that argument in a June piece published by The Hacker News.
A BAS platform works from a library of attacker behaviors, usually mapped to MITRE ATT&CK, and replays them in a controlled way on real endpoints, networks, and cloud accounts. The output is a scorecard rather than a list of flaws: for each technique, did a control block it, did anything log it, and did an alert reach a person. That last result is often the weakest. In Picus’s Blue Report 2026, drawn from 338 million simulations, controls prevented 69% of tested actions and logged 58%, yet only 14% produced an alert. Treat vendor benchmarks with care, but the gap between logging and alerting is worth checking in your own stack.
| Vulnerability scanning | Penetration testing | Breach and attack simulation | |
|---|---|---|---|
| Question it answers | Which known flaws exist on our assets? | Can a skilled person get in, and how far? | Do our controls block, log, and alert on known techniques? |
| Typical cadence | Continuous or weekly | Periodic, often yearly | Continuous or on demand |
| Output | List of CVEs and misconfigurations | Narrative of the paths found | Pass or fail per technique and per control |
| Blind spot | Exploitability and control coverage | Everything that changes between tests | Novel exploits and business logic flaws |
These are complements, not substitutes. Scanning finds candidates, BAS shows which ones your controls already contain, and pentesters find creative chains that neither tool would try.
What to do now
A validation-first workflow can sit on top of the vulnerability management tools you already run:
- Tag exposure. Mark each asset as internet-facing or internal and flag systems that hold critical data. An outside-in external attack surface assessment catches hosts your asset inventory missed.
- Add exploitation signals. Attach KEV status, the EPSS probability of exploitation in the next 30 days, and CISA’s automatable and technical impact values from its SSVC work to each finding.
- Confirm reachability. Check that the vulnerable service is running, the port is open from where an attacker would sit, and the version really matches.
- Validate controls. Simulate the techniques attackers use after exploiting that class of flaw, and record block, log, and alert results.
- Sort into three tiers. Fix now: reachable, exploited or automatable, and not stopped. Mitigate and schedule: reachable, but simulations show it blocked and alerted, so the fix can wait for the next planned maintenance window. Track: not reachable.
- Retest after every fix and after every significant control or policy change.
What to measure
- Median and 90th percentile time to fix validated, internet-facing exposures, rather than all CVEs.
- The count of validated exposures over time, in place of total open findings.
- Prevention, logging, and alerting rates per ATT&CK technique.
- Time to detect during simulations.
- Time from a new advisory to a tested answer to “are we exposed?”
Pitfalls to avoid
- Treating a pass as a waiver. A blocked simulation buys time, not immunity. CISA’s implementation guidance says that apart from removing the asset from the network, the only known technical mitigation for a KEV entry is the required action listed in the catalog.
- Measuring only prevention. A technique that is logged but never alerts is invisible to your analysts. If alert volume is the constraint, see how an AI SOC handles triage.
- Stale scenarios. Refresh test content when new advisories land, or you end up validating against last year’s attacker.
- Ignoring exposure that has no CVE. The FortiGate campaign needed no vulnerability at all. Test for default credentials, missing MFA, and exposed admin interfaces too.
- Unsafe testing. Scope targets, require approvals, and keep a kill switch before you simulate anything in production.
If you want to put the control validation step into practice, Jutsu’s Red Team runs MITRE ATT&CK-mapped scenarios against scoped, authorized targets and correlates each run with SIEM events, reporting detection rate, time to detect, and the techniques your detections missed. Pair it with an outside-in view of what is reachable, and your patch queue starts to reflect real risk instead of raw severity.