In the first half of 2026, a whopping 35,853 CVEs were published — roughly 49% more than in the year before — yet only 495 of those were catalogued as exploited in the wild, and just 116 were already under attack on the day they became public.
Explosive CVE growth and the narrowing window to exploit
The raw numbers tell two linked stories: vulnerability discovery is accelerating at scale, and the time between public disclosure and real-world exploitation is compressing. Anthropic’s disclosure data, cited in the source analysis, reports that Mythos-class models surfaced 26,153 vulnerability candidates in open-source software, but only 421 of those candidates were patched upstream. That contrast — tens of thousands of findings versus a few hundred actionable remediations — underlines a practical triage problem for defenders.
Why CVSS gives you a baseline, not a decision
The Common Vulnerability Scoring System (CVSS) remains useful as a common severity baseline, but it cannot answer the questions defenders actually need answered: is the exposure reachable in this environment? do existing controls interrupt exploitation techniques? does the vulnerable instance sit on a business-critical asset where prevention fails and detection never fires? The same CVE can touch hundreds of instances with divergent operational impact; severity alone cannot resolve which of those require immediate action.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAutomated pentesting: strong evidence, limited coverage
Automated and agentic pentesting can produce some of the strongest evidence available: they can run real exploits, chain vulnerabilities and misconfigurations into attack paths, and demonstrate attacker progression across an environment. But coverage remains constrained in practice. Omdia research cited in the source found that while 95% of organizations rank pentesting as a top or high priority, only 32% of their average attack surface is tested each year. Practical limits also persist: a working exploit must exist for CVE-based tests, and many business-critical, restricted, or air-gapped targets are unsafe to test live.
A three-part validation model: exploitability, control, and agentic pentesting
The solution the source proposes is not a single technique but a coordinated validation program made of three complementary methods. Exploitability validation determines whether an exposure is exploitable in your environment, including for CVEs with no working exploit and for assets that cannot be safely tested live. Security control validation tests whether prevention and detection controls actually block, detect, or miss the attack. Agentic pentesting safely runs real exploits and chains exposures to show the potential attacker path. Together, these approaches let evidence from different conditions feed a single decision process: prioritize, patch, test, and re-validate.
The source also notes that Gartner’s May research note points in the same direction: toward validated attack paths, decision-driven response, and exposure reduction integrated into operational workflows.
Picus Validation Summit ’26 and real-world exemplars
Picus Security is hosting the Validation Summit ’26 on October 14–15 to translate this model into practice. Agenda highlights in the source include an opening by Mikko Hyppönen, a presentation from Picus CTO Volkan Ertürk on validation when "attackers are powering their attacks with AI," and a live workflow demo that begins with a newly disclosed vulnerability that has no patch and no working exploit, moves through validation before a proof-of-concept exists, tests the exploit against live controls once it appears, and then re-validates after the fix. Security leaders from Chanel, Atlassian, and the NFL are slated to describe their internal validation programs, including changes made and lessons learned. The event is presented as a compact two-hour blueprint for validated decision-making.
What this means for security teams, enterprise leaders, and open-source maintainers
- Security teams: must shift from severity-driven triage toward evidence-driven validation — using exploitability and control tests to decide which exposures on which assets demand immediate action.
- Enterprise leaders and procurement: should demand validation workflows that integrate different evidence types so fixes can be re-validated and remediation priority adjusted as new proof arrives.
- Open-source maintainers: will see large numbers of candidates surfaced by tools like Anthropic’s Mythos-class models (26,153 candidates reported) while only a small fraction (421) are being patched upstream, highlighting a supply-side bottleneck between discovery and remediation.
The central, practical point from the source is stark: defenders cannot treat every High-or-Critical CVSS score as an emergency. The critical task is narrowing tens of thousands of findings to the small subset that is actually exploitable, reachable, and consequential within a specific environment — and building validation programs that produce the evidence to drive those decisions.
https://thehackernews.com/2026/09/ai-changed-exposure-problem-validation.html
