AI Changed the Exposure Problem. Validation Needs to Change With It.

The Discovery Firehose Has Outrun Triage

A contributed piece on The Hacker News, written by Sila Ozeren Hacioglu, a security research engineer at Picus Security, makes a straightforward but uncomfortable argument: AI hasn't just made it easier to find vulnerabilities — it has broken the assumption that every finding deserves a human's immediate attention. Discovery is scaling faster than any security team's ability to work out which of those findings actually matter.

The piece isn't framed as a general AI-security thinkpiece so much as a direct challenge to how most organizations still triage: by CVSS severity score, treating every "High" or "Critical" rating as an emergency. That model, the article argues, was never really "wrong" — it was just built for a slower world, and AI-accelerated discovery has broken it.

The Numbers Behind the Argument

The gap is the whole argument: tens of thousands of new CVEs land every six months, but only a sliver ever turn into a real-world attack — and a meaningful chunk of that sliver is already being exploited before most teams have even read the advisory. Meanwhile, AI-assisted vulnerability research (the piece cites Anthropic's own disclosure data) is now surfacing candidate flaws in open-source software at a volume — over 26,000 in the sample cited — that dwarfs the number that upstream maintainers can realistically patch.

Put those two data sets together and the piece's thesis becomes clear: AI has widened both ends of the funnel at once. More candidate vulnerabilities go in the top, and defenders still only have the bandwidth to meaningfully respond to a couple hundred at the bottom.

Why CVSS Alone Doesn't Answer the Real Question

The article's central complaint about severity-score-driven triage is that CVSS was never designed to answer the question security teams actually need answered. As the piece puts it, "The CVSS gives you a common severity baseline. It can't give you the context that determines impact to your organization."

A 9.8-rated CVE dropping in a component nobody in your environment actually exposes to the internet is a very different problem than a "Medium" flaw sitting on an internet-facing system with no compensating controls — and severity scoring alone can't tell the two apart. The piece's blunt framing: "treating every vulnerability with a High or Critical CVSS rating as an emergency is not only impossible, it's actually the wrong model."

The Proposed Fix: Validate, Don't Just Score

Rather than more scanning or more scoring frameworks, the article argues for shifting effort toward validation — actually testing whether a given exposure is exploitable in your environment before treating it as a fire drill. It breaks the approach into three parts:

• Exploitability validation — determining whether a disclosed flaw is actually reachable and exploitable against real assets, not just theoretically present
• Security control validation — testing whether existing prevention and detection controls (EDR, WAF, segmentation, etc.) would actually catch or block an attempt to exploit it
• Agentic pentesting — using automated agents to safely run real exploit chains end-to-end, rather than relying on point-in-time manual pentests

The idea is a continuous loop rather than a periodic audit: as new candidate vulnerabilities appear (increasingly from AI-assisted discovery on both the offensive and defensive sides), validation runs continuously to separate "theoretically severe" from "actually exploitable here."

Worth Noting: This Is a Vendor Op-Ed

It's worth being upfront that this is a contributed/sponsored-style piece, not independent reporting — it's written by a Picus Security employee, and Picus sells exactly the kind of exposure-validation platform the article is arguing organizations need. Earlier in 2026 the company launched its Autonomous Exposure Validation Platform, built around what it calls "Picus Swarm" (five specialist agents covering discovery, exploitation, validation, mobilization, and reporting, orchestrated by an engine Picus calls "Numi AI"). The article also promotes Picus's upcoming Validation Summit '26, with speakers drawn from Chanel, Atlassian, and the NFL.

None of that makes the underlying data or argument wrong — the CVE volume and exploitation-rate figures are consistent with the broader industry shift toward exposure management and away from pure vulnerability scanning — but readers should weigh the piece as advocacy for a product category, not a neutral study.

Sources

• The Hacker News — AI Changed the Exposure Problem. Validation Needs to Change With It.