AI Changed the Exposure Problem. Validation Needs to Change With It.
Picus Security argues vulnerability validation must combine exploitability, control validation, and agentic pentesting as AI accelerates disclosure volume.
Picus Security reports 35,853 CVEs were published in H1 2026, roughly 49% more than the prior year, while only 495 were catalogued as exploited in the wild and 116 were attacked on disclosure day. The vendor argues CVSS-based triage is inadequate and promotes combining exploitability validation, security control validation, and agentic pentesting into one program. The post also cites Anthropic data showing Mythos-class models surfaced 26,153 open-source vulnerability candidates with only 421 patched upstream, and promotes Picus's Validation Summit '26 on October 14-15.
- H1 2026 saw 35,853 CVEs published; only 495 exploited in the wild.
- CVSS severity alone cannot determine impact in a specific environment.
- Proposes unified exploitability, control, and attack-path validation.
- Promotes Validation Summit '26 on October 14-15.
From the original article
4 min read at thehackernews.com
There's a lot of noise around AI and cybersecurity right now. What’s actually important is far simpler, if often lost in the hubbub. Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.