AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.
Summary: Anthropic reported in its May 2026 update that it and roughly 50 partners used Claude Mythos Preview to find more than 10,000 high- or critical-severity vulnerabilities in systemically important software in a single month, and that more than 99% of what it found remained unpatched at the time of writing. The article cites Zero Day Clock putting the 2026 average time-to-exploit at roughly 24 hours, down from about 53 days in 2024, and Verizon's 2026 DBIR tying 32% of initial-access techniques to vulnerability exploitation.
Bottom line: Verizon's DBIR found even the best-performing organizations close only 30-40% of known-exploited vulnerabilities in the first week after detection, a rate that has barely moved despite years of investment, while the median organization had to patch 16 known-exploited vulnerabilities in 2025, up from 11 the year before.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026