You Don't Have to Run an Exploit to Know If You're Vulnerable

The Disappearing Timeline of Vulnerability Management

For decades, defenders could count on weeks or months between a flaw becoming public and anyone actually turning it into a working attack. However, two forces have closed this gap at once. The first is sheer volume: new flaws are piling up far faster than ever before, with the first half of 2026 alone producing more CVEs than any full year on record prior to 2024, arriving at an alarming rate of roughly one every 7.4 minutes. The second is speed. AI has quickly erased what was left of the cushion, as we mentioned in a recent article. Today, turning an advisory into a live exploit no longer takes skilled, patient effort.

The Widening Stretch of Time

Unfortunately for security teams, defenses haven't moved anywhere near that fast, and no team can patch its way out of a backlog that's literally growing by the minute. But volume was only part of the problem: only a fraction of a percent of those CVEs was ever turned into a live, in-the-wild attack. What opens up is a widening stretch of time where attackers act freely, with defenders powerless to stop them.

The Compounding Problem of Proof

The compounding problem is proof, separating the handful of threats that can actually be turned against you from the tens of thousands that never will. The Risk Lives Where You Can't Fire Running pentests continuously instead of once a quarter certainly narrows that stretch, but it carries a hard ceiling. A live exploit, used by automated pentest tools, can only be launched where it's safe to do so and where a usable exploit already exists, which in most enterprises covers only 10 to 15% of their actual attack surface.