AI Changed the Exposure Problem — Validation Needs to Change With It

Introduction

There's a lot of noise around AI and cybersecurity right now. What's actually important is far simpler, if often lost in the hubbub: vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action.

This is the new exposure problem. AI has changed the game, but the way most security teams prioritize vulnerabilities hasn't kept up.

The Numbers That Matter

The scale of the problem becomes clear when you look at the data from the first half of 2026:

Meanwhile, Anthropic's own disclosure data shows Mythos-class models surfacing 26,153 vulnerability candidates in open-source software, with only 421 of those getting patched upstream.

The critical task security teams face is deciding which exposures, on which assets, require immediate action — especially as both the number of findings grows and the gap between disclosure and exploitation narrows.

Why CVSS Alone Can't Tell You What Matters

The same CVE can affect hundreds of assets, but the impact is rarely the same across them.

Consider these scenarios:

• Some instances are unreachable
• Some sit behind controls that interrupt the techniques required for exploitation
• Others are exposed on business-critical systems where prevention fails and detection never fires

The CVSS gives you a common severity baseline. It can't give you the context that determines impact to your organization.

Automated Pentesting Alone Can't Validate Every Exposure

Once you move beyond severity scores, automated pentesting gives you some of the strongest evidence you can gather. It can:

• Run real exploits
• Prove that an exposure is exploitable in your environment
• Chain vulnerabilities, credentials, and misconfigurations into attack paths
• Show how far an attacker could actually progress across your network

Yet coverage remains limited in practice. Omdia research found that while 95% of organizations rank pentesting as a top or high priority, only 32% of their average attack surface is tested each year.

The constraints of live exploitation:

• For CVE-based exploitation, a working exploit still has to exist
• The target has to be safe to test
• Newly disclosed CVEs may have no working exploit yet
• It may not be possible to test a live exploit on business-critical, restricted, and air-gapped assets

Three Pieces That Work Together

This is where the pieces come together. Modern validation requires three capabilities working in concert:

This doesn't mean you have to always use all three against every exposure. The goal is to apply each method where it fits best and let the evidence contribute to the same decision process.

Making Validation a Program, Not a Workflow

These three key pieces become even more powerful when they operate as one program:

• A finding can trigger the validation step it actually needs
• New evidence can change remediation priority
• Fixes can be re-validated instead of disappearing into a closed ticket

That keeps exploitability, control effectiveness, and attack-path evidence connected instead of leaving them to wallow in separate workflows.

What Gartner Says

Gartner's May 2026 research note points toward validated attack paths, decision-driven response, and exposure reduction all integrated into operational workflows.

This is a significant shift from the traditional "scan and prioritize by severity" model that most organizations still use. Instead, Gartner is recommending that organizations:

• Validate which exposures are actually exploitable
• Prove whether security controls work as intended
• Connect evidence across validation methods
• Integrate validation into operational workflows

The Validation Summit '26

On October 14 and 15, Picus Security will host The Validation Summit '26 to bring together an independent view of what's changed, their approach to validation, and lessons from security leaders who've already put it into practice.

The event will feature:

• An independent view of what's changed in the threat landscape
• Picus Security's approach to validation
• Lessons from security leaders who've implemented validation programs

What This Means for US and UK Businesses

For organizations across the United States and United Kingdom, this shift in validation strategy has significant implications:

• Volume is overwhelming — 35,853 CVEs in just six months means teams must be selective
• CVSS isn't enough — Context from your own environment determines actual risk
• Coverage is limited — Only 32% of the average attack surface is tested annually
• Multiple methods needed — Exploitability validation, control validation, and agentic pentesting work together
• Integration is key — Validation should be a program, not isolated workflows
• Continuous improvement — Re-validating fixes prevents regressions

Final Thoughts

AI has fundamentally changed the exposure problem. Vulnerability discovery is faster, happens at a greater scale, and the gap between disclosure and exploitation is narrowing. The old model of prioritizing by CVSS alone no longer works.

Security teams need to move toward a unified validation approach that combines exploitability validation, security control validation, and agentic pentesting into a single, integrated program.

Key takeaways:

• 35,853 CVEs published in H1 2026 — up 49% year-over-year
• 495 exploited in the wild — the exploited subset is small and important
• CVSS alone — can't provide the context that determines impact
• Automated pentesting — provides strong evidence but has coverage limits
• Three validation methods — exploitability, control, and agentic pentesting
• Integrated program — keeps evidence connected and remediation continuous
• Gartner alignment — validated attack paths and decision-driven response

If your organization needs assistance with vulnerability management, exposure validation, or modern security operations, contact SystemLogicIT for expert guidance across the United States and United Kingdom.