When AI-Accelerated Discovery Outruns Patching, Exploitability Proof Decides What Gets Fixed First | Qualys
Summary: Qualys joined Athena, the open source defense coalition Chainguard launched, and reports that in Athena's first three weeks it processed tens of thousands of findings, 42 percent of them critical or high severity. Qualys cites Mandiant M-Trends data putting mean time-to-exploit at negative seven days, and its own analysis of more than a billion CISA KEV remediation records across 10,000+ organizations showing closed vulnerability events grew 6.5x from roughly 73 million in 2022 to 473 million in 2025 while the share of critical KEV vulnerabilities still open at Day 7 rose from 56 percent to 63 percent.
What you should know: Fewer than one percent of vulnerabilities labeled critical are ever exploited in the wild, yet the Day 7 open rate on critical KEV entries climbed to 63 percent - so remediation capacity is being spent on theoretical findings while the genuinely exploitable ones wait in the same queue. Seven percent of Athena's early findings sit in packages more than five years old, many silently fixed upstream with no CVE for a scanner to key on.
Read the original at Qualys Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026