Having spent years at Qualys working on vulnerability risk and remediation management, I have watched the disclosure and remediation cycles from every angle. I have seen vulnerability researchers find a critical flaw in OpenSSH and the industry scramble to respond. I have seen organizations patching Log4Shell when it is not even applicable in production environments. But, more and more, I am watching the gap between when something is known to be exploitable and when it gets fixed stay stubbornly, dangerously wide.

A New Threat Landscape: What Mythos Changes

In April 2026, Anthropic released a frontier AI model — as part of Project Glasswing — that can autonomously find and exploit vulnerabilities in production software at a depth and speed that previously required experienced human researchers. Major software vendors now have access. The result: a surge of vendor advisories, patches, and CVE disclosures is coming — on top of a backlog that was already strained.

The harder part of vulnerability management is what comes after: figuring out which findings represent real, exploitable risk in your specific environment — with your mitigation controls in place and against your most critical business services — and closing them before someone acts on them. That gap has always been the harder problem, especially as attackers started to use AI-assisted exploitation. The current moment makes it more urgent than ever.

A vulnerability found by any tool does not automatically make it a risk in your environment. A critical flaw behind a WAF that fully blocks the attack vector is not your urgent problem. A moderate-severity flaw in an exposed, unpatched internet-facing service with active exploit code in the wild very much is. That gap between “vulnerability found” and “real risk in your environment” is where most remediation capacity gets wasted.

What is Changing

A Vulnerability Surge and an Exploitation Window That Has Already Closed

Most security teams already carry a backlog of known, unresolved exposures — not because they are negligent, but because volume has always outpaced remediation capacity. Now layer on two things: Mandiant’s 2024 data shows exploitation timelines have reached minus one day — attackers weaponize before the patch exists. With attackers deploying agentic AI to automate reconnaissance and exploit development, the window from disclosure to in-the-wild exploitation has collapsed from weeks to hours. And AI-assisted research will now accelerate new disclosures arriving on top of everything already in your queue.

Attackers exploited a risky exposure on average within 17 days, and now it’s even shorter. The industry average remediation time is 37+ days. That is a 20+day window of known, confirmed, open exposure. More disclosures arriving faster widens the intake side of that gap. Nothing about AI-assisted discovery closes the output side.

How to Adapt

Dashboard Tourism Is Over. Prioritization and Remediation Must Run at Machine Speed.

Every organization has some version of this: security dashboards shared, reviewed in meetings, handed off across teams. When exploitation windows collapse to hours, the time spent reviewing and discussing risk is time during which the exposure is open. Every handoff between detection tools, prioritization tool, ticketing system, IT team, and change management is a delay. The seams between siloed tools are where risk lives.

Detection has always been the relatively easier half of the vulnerability management problem. The harder half is what comes after: figuring out which findings represent real, exploitable risk in your specific environment — with your mitigation controls in place, against your most critical business services — and closing that risk before someone acts on it. That gap has always been the harder problem, especially as attackers started to use AI-assisted exploitation. The current moment makes it more urgent than ever.

The harder truth: If everything is critical, nothing is! The only viable response is prioritization that is genuinely context-aware: not theoretical or CVSS scores, but what is exploitable in your environment, against your assets, with your compensating controls in place. Business context is not optional — it is the difference between managing real risk and counting theoretical vulnerabilities.

The Only Metric That Matters Now
Average window of exposure (AWE), not compliance-centric MTTR, 30-day SLAs. Patch counts, etc. These were designed for a world where you had time to operate them. In an environment where exploitation timelines are measured in hours, only one metric maps to real risk reduction: time between a confirmed exploitable exposure entering your environment and validated closure. That is the one most organizations currently cannot measure.

Manual Remediation Is Dead. Operationalizing Fast Remediation, Beyond Patching, Is the Need of the Hour.

I want to be direct about this. The phrase “autonomous remediation” generates more skepticism than almost anything else in security operations. Security teams have been burned by automated patching that broke production. They have watched “auto-deploy” systems create incidents worse than the vulnerability they were trying to close. That skepticism is earned.

But here is the other side of that equation: manual remediation at the speed the current environment demands is not operationally viable. The human-in-the-loop for every remediation step — approval, scheduling, deployment, verification — is the structural bottleneck. It was already too slow before AI-accelerated discovery. It is untenable after it.

The answer is not to eliminate human judgment. It is to build the trust infrastructure that makes autonomous action safe enough to deploy at scale.

Three things are required:

1. Validate before you remediate with attackers’ techniques in your production environment, beyond just attack paths

Remediation resources are finite. Committing them to theoretical risks and attack paths stays in the failure mode. It is more important to drive autonomous validation of the exploitation of these risky exposures by running through an attacker’s actual entry path in the production environment, not a simulated environment, without disrupting production. Binary answer: exploitable or not. Not probable. Confirmed. Qualys’ Threat Research Unit (TRU) team has found <1% of the theoretically risky exposures are confirmed validated, which become p0 to fix.

2. Options beyond patching – mitigate risk until downtime

Patching is not always immediately possible. Production windows, legacy systems, operational constraints, and competing priorities are real. The security teams that get overwhelmed are the ones whose only remediation lever is “wait for the patch and deploy it.” That is not a resilient posture.

The lever most organizations under-invest in is policy and control improvement: crafting custom rules for your EDR, WAF, firewalls, and CSPMs that buy protection when the patch does not yet exist or cannot yet be deployed. Leveraging the full spectrum of virtual patching, mitigations, etc., in an adaptive manner when the patch reliability score is low, from mitigation to virtual patch, WAF rule, host isolation, service disablement, compensating control — helps balance business continuity with timely risk reduction.

3. Trust comes from operational evidence, not promises

Autonomous remediation is not a feature you deploy on faith. It is a capability you earn through accumulated evidence: deploy patches leveraging the AI-based reliability score which predicts operational risk before deployment runs, based on the errors found by the community and success/failure observed by your industry peers; the wave-based deployment architecture that builds confidence at each ring before the next proceeds; the auto-rollback that triggers when system behavior deviates gives the backup plan to return to safety.

The Trust Equation
Autonomous remediation that breaks production is not remediation. It is an incident. The path to machine-speed remediation runs through trust architecture, not through speed alone. You earn the right to go faster by demonstrating you can go safely.

Custom Software Is Not Exempt: Extending Detection to Your Own Applications

Most attention focuses on third-party commercial software. But every enterprise also runs custom applications — internal tools, proprietary APIs, business-critical services — and these will increasingly surface vulnerabilities through AI-assisted research too. The key insight is simple: it does not matter how a vulnerability gets found. What matters is whether you can detect it in your running environment, validate exploitability, and close it at the same speed you would a critical third-party CVE. It has become ever so critical to extend the power of agentic AI to finding vulnerabilities before production, taking the input, and creating custom signatures to detect and remediate these vulnerabilities in the production environment.

This is why a Risk Operations Center (ROC) is needed — to operationalize your risk management program at AI speed and stop vulnerability whack-a-mole.

Qualys Enterprise TruRisk Management

From Findings to Validated, Closed Risk

Qualys Enterprise TruRisk Management (ETM) addresses each of these challenges in sequence. Three capabilities close the loop from raw exposure volume to validated, closed risk.

1. Prioritize in real time: from findings to the <1% that actually matter

TruRisk aggregates assets, exposures from Qualys and third-party tools — Wiz, CrowdStrike, Microsoft Defender, 100+ others — scoring every exposure against 25+ threat intelligence sources alongside actual business context: which assets are internet-facing or revenue-critical, which threats actively target organizations like yours, does it have another toxic combination — open RDP port, privileged access —and which compensating controls are already in place.

2. Validate exploitation: confirmed in your environment, not on paper

Before committing any remediation resources, one question must be answered: Is this actually exploitable in my environment, with my controls, right now? TruConfirm, powered by Agent Val, intelligently selects risky exposure, your internet-facing assets, and uses appropriate safe payloads to replicate the attacker’s technique to validate exploitation of these exposures, without production disruption — binary result, cryptographic proof. Agent Val runs this autonomously across 1,700+ CVEs with >95% noise reduction, feeding confirmed attack paths directly into the remediation queue, driving adaptive remediation to revalidate closure of risk.

3. Remediate adaptively: patch, mitigate, isolate, or remove at machine speed

Not every confirmed exposure can be patched immediately. TruRisk Eliminate drives remediation across the full spectrum: patching via Qualys or integrated tools (SCCM/Intune, CrowdStrike, ServiceNow), patchless mitigation through configuration changes and WAF rules, asset isolation, and removal of risky unused software. The AI-based Patch ReliabilityScore — trained on 150M+ deployed patches — predicts operational risk before deployment and stages rollout in waves. Auto-rollback on deviation. The result: 40+ autonomous patches deployed with zero human intervention, <0.1% rollback rate, and organizations remediating confirmed exposures in under 18 days, against an industry average of 67. For ransomware and CISA KEV exposures: detection to validated remediation in under 15 minutes.

The Bottom Line

Operationalizing Real-Time Risk Management Is the Defining Challenge of the Next 12 Months.

AI-assisted research accelerates finding vulnerabilities. It does nothing about what comes after. The organizations that navigate this era do four things:

  • Prioritize with context, not scores. CVSS measures theoretical global severity. Effective prioritization means your environment: your assets, threat actors in your industry, toxic combinations with attack surfaces such as open ports, misconfigurations, your mitigation controls, and your business context.
  • End dashboard tourism. Compress the loop from detection to confirmed closure. Time reviewing and coordinating is time the exposure is open.
  • Build trust in autonomous remediation — through AI reliability scoring, staged wave deployment, and auto-rollback. Evidence earns the right to move faster.
  • Prove risk is closed, not patched. Replace patch count metrics with before-and-after Average Window of Exposure (AWE) and revalidation confirmation that the risky exposure is no longer exploitable in your environment.

The era of human-speed vulnerability management is over. The question is: How quickly can you adopt and trust autonomous remediation?

Learn more about Qualys ETM.



Source link