AI-driven acceleration of exploitation timelines reduces window between vulnerability disclosure and active attacks
Summary
Hide ▲
Show ▼
In 2025, threat actors leveraged AI and automation to compress the time between public vulnerability disclosure and exploitation from weeks to days or even minutes, significantly reducing the traditional "predictive window" for defenders. The median time between vulnerability publication and inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog decreased from 8.5 days to 5 days, while the mean dropped from 61 days to 28.5 days. The use of AI accelerated reconnaissance, automated decision-making, and industrialized social engineering, enabling rapid weaponization of known weaknesses such as exposed services, weak identity controls, and unpatched edge infrastructure. Confirmed exploitation of high-severity CVEs (CVSS 7–10) rose 105% year-over-year, with deserialization, authentication bypass, and memory corruption flaws most frequently exploited—often against file transfer systems, edge appliances, and collaboration platforms.
Timeline
-
18.03.2026 15:00 1 articles · 2h ago
Exploitation speed accelerates to near-immediate following vulnerability disclosure in 2025
Rapid7’s analysis shows a collapse in the time-to-exploit window, with the median time from vulnerability disclosure to KEV inclusion dropping to 5 days and mean time to 28.5 days. AI-driven automation is cited as the key driver behind this compression of attacker timelines, enabling rapid discovery and weaponization of vulnerabilities in exposed services, edge devices, and collaboration platforms.
Show sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00
Information Snippets
-
Median time between vulnerability disclosure and KEV catalog inclusion dropped from 8.5 days to 5 days in 2025.
First reported: 18.03.2026 15:001 source, 1 articleShow sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00
-
Mean time between vulnerability disclosure and KEV catalog inclusion decreased from 61 days to 28.5 days in 2025.
First reported: 18.03.2026 15:001 source, 1 articleShow sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00
-
Confirmed exploitation of CVSS 7–10 vulnerabilities increased 105% year-over-year, from 71 in 2024 to 146 in 2025.
First reported: 18.03.2026 15:001 source, 1 articleShow sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00
-
Vulnerability exploitation accounted for 25% of initial access vectors in incident response engagements, with exposed services on 7% and valid account/no MFA on 44%.
First reported: 18.03.2026 15:001 source, 1 articleShow sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00
-
Top exploited vulnerability classes in 2025 included deserialization, authentication bypass, and memory corruption flaws.
First reported: 18.03.2026 15:001 source, 1 articleShow sources
- AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure — www.infosecurity-magazine.com — 18.03.2026 15:00