Enhanced Detection Engineering at Scale in the Agentic Era
Summary: GreyNoise's new Head of Adversary Engagement writes that CVE entries rose from 16,510 in 2018 to 48,162 in 2025, with 130% growth from 2022 through 2025, and that the mean time to exploit has dropped to slightly negative, meaning the average vulnerability was likely exploited before it was reported and assigned a CVE number. The company is building agentic workflows on frontier large language models to draft detection logic and collect references for each CVE, with detection engineers reviewing the agents' output before a GreyNoise Tag is published.
Why it matters: When the average CVE is exploited before it has a number, a detection pipeline that waits for publication and then runs a manual research workflow is already behind - which is why GreyNoise is handing the first pass to agents and keeping engineers on review.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026