Our takeVulnCheck's research finds only 1% of AI-discovered vulnerabilities see wild exploitation so far. That suggests AI currently helps defenders more than attackers.Security Resilience desk
Sources (1)
- infosec_mag · infosec_mag
What this means for you — Security leader:Treat discovery method as secondary to exploitability. Keep prioritizing with KEV, EPSS, and observed-in-the-wild signals rather than whether a CVE was found by AI.
What this means for you — Lean IT orgs:You do not need a special process for AI-found bugs. Patch what is known to be exploited first, then follow your normal update cycle for the rest.
What this means for you — MSP:When clients ask about AI-discovered CVEs, point them to KEV/EPSS and in-the-wild status across their stacks instead of elevating items solely because AI found them.
What this means for you — Researcher:VulnCheck claims only about 1% of AI-discovered vulnerabilities show exploitation in the wild and that AI currently helps research more than attackers; review their methodology and sample before citing the figure.