Vulnerability management needs an update for the AI era
AI accelerates exploit timelines from months to hours. Organizations must shift from patch-all to risk-based prioritization using exploitability metrics.
Organizations must rethink long-held assumptions about patch management and change how they prioritize, remediate and manage cyber-risk, especially in the age of AI.
Since 2019, the average time between vulnerability disclosure and confirmed exploitation has collapsed from months and weeks to mere hours. CISOs and their teams have far less time to assess risk, prioritize remediation and protect critical assets. CVSS scores, never a great measure of real-world risk on their own, are even less meaningful without additional metrics such as exploitability and asset criticality.
More than just patch deployment
Today, vulnerability management is less about simply deploying patches and more about continuously identifying and reducing the exposures attackers are most likely to exploit.
"Organizations should stop treating vulnerability management as a closed loop ending in a patch," said Nicole Carignan, senior vice president of security and AI strategy and field CISO at Darktrace.
Instead, security leaders must prioritize their responses based on exploitability, exposure, asset criticality and the organization's ability to detect and contain exploitation if patching is delayed. "They need to know where they are exposed, what normal behavior looks like, whether they can identify out-of-place activity and autonomously respond or contain it before it becomes a larger incident," she said.
Follow the feds
The shift is already underway within U.S. federal civilian executive branch agencies. CISA recently issued binding operational directive 26-04 as a response to new challenges stemming from AI-driven vulnerability discovery and exploit development. The ruling effectively replaces traditional severity-driven patch management with a risk-based model that requires agencies to consider factors such as active exploitation, internet exposure, exploit automation potential and attack impact.
The directive also requires agencies to remediate the highest-risk vulnerabilities within three days; lower-priority threats can be deferred. Significantly, as part of the mandate, federal agencies must conduct a full forensic triage after remediating high-priority vulnerabilities to determine whether their systems are already compromised.
The directive reflects a broader recognition that technical severity alone is no longer an adequate guide for remediation decisions. Instead, organizations increasingly need to weigh a vulnerability's likelihood of exploitation alongside the potential operational and business impact of a successful attack.
Put CVSS in context
Even as vulnerability management tactics evolve, CVSS can still help companies prioritize risk initially, said Jeffrey Wheatman, senior vice president and cyber-risk strategist at Black Kite. But additional context will be vital, especially metrics such as the likelihood that a vulnerability will be exploited in the next 30 days -- as measured by the Exploit Prediction Scoring System. When making patching decisions, organizations need to gather context about the potential operational and financial impact of a specific vulnerability in their environment.
Architect your program as patch intelligence, not patch management.
Jeffrey Wheatman, senior vice president and cyber-risk strategist, Black Kite
Given the sheer velocity of AI-driven vulnerability discovery, organizations should shift from a "patch it all" mentality to a "patch what can cause damage right now" approach, Wheatman said. "Create remediation tiers with appropriate targets, not one giant patching list."
Business risk is paramount. Companies should focus on that before considering severity or technical risk, he said, adding that organizations should supplement patching with other mitigation measures such as disabling vulnerable features, blocking exploit pathways, rotating credentials and monitoring data access. "Architect your program as patch intelligence, not patch management," he said.
Jeff Williams, founder and CTO of Contrast Security, advises security leaders to invest in their abilities to quickly answer questions around how vulnerable components are deployed, configured, invoked and exposed in their production environment. That data, he said, is often far more valuable than a generic CVSS score designed to apply equally to all organizations.
"Organizations were never supposed to stop at the base score of a CVE," said Williams, who is also a co-founder of OWASP. "The real value comes from combining technical severity with threat intelligence, environmental context and business impact. In an AI-driven threat environment, that full picture matters more than ever."
Once those details are realized, Williams said, the second step is to reduce the inflow by eliminating vulnerability backlog and improving secure development practices. And the third step is to assume vulnerabilities will exist and deploy runtime protections that prevent exploitation while remediation is underway.
Focus on behavioral analytics
Detection and mitigation models that rely on known attack signatures or previously observed exploit techniques have long been insufficient and will become even less effective in the AI era. AI enables attackers to rapidly generate novel payloads and variations far faster than detections and signatures can be developed to keep pace.
In response, organizations must rely far more heavily on behavioral detection approaches that identify deviations from expected system and user activity. This includes monitoring for unusual authentication patterns, abnormal process behavior and anomalous data access flows that might indicate compromise even when no known signature or exploit pattern exists. Compensating controls, including network segmentation and tighter enforcement of least-privilege access, should become a primary layer of defense rather than a temporary fallback when vulnerabilities cannot be patched quickly enough. These techniques, which also include token and credential scoping and application-level allowlisting, aren't new, but they are quickly becoming indispensable.
"Organizations need to invest in scaled visibility, behavioral analytics, anomaly detection, autonomous investigation and autonomous containment across endpoints, network, cloud, identities, SaaS and critical infrastructure," Darktrace's Carignan said.
To that end, defenders must shift away from traditional approaches and move toward those that identify anomalous behavior. Organizations these days are defending against a lot more than just software flaws. Identity and credential theft, human error, insider threats, misconfigurations, misuse of AI tools and AI systems that introduce new risk all must be part of the security model.
"If a system cannot be patched quickly, the organization still needs to detect attempted exploitation and contain it at machine speed," Carignan said.
Continuous vulnerability management
Douglas José Pereira dos Santos, senior director of advanced threat intelligence at FortiGuard Labs, said organizations must stop thinking about patch management as a discrete operational cycle and instead focus on continually managing vulnerability exposure.
Getting there requires several structural shifts, he said. Remediation SLAs, for example, should be built on layered risk signals that include exploitation likelihood, asset exposure and business impact. Threat intelligence needs to be part of the triage decision the moment a vulnerability enters the queue and not a separate enrichment step that occurs later in a different part of the organization. Similarly, compensating controls need to be treated as formal, documented risk mitigation mechanisms rather than informal workarounds.
"The operational shift required is from prevention as the primary control to resilience as the underlying design principle," dos Santos said. At the same time, organizations must assume some exploitation will occur and engineer their environments to detect and contain attacks rapidly.
Jaikumar Vijayan is a freelance technology journalist with more than 20 years of award-winning experience in IT trade journalism, specializing in information security, data privacy and cybersecurity topics.
