Vulnerability Management in the Age of AI
For thirty years, vulnerability management has relied on a buffer of months between vulnerability discovery and exploitation. However, with the advent of AI, this buffer has been stripped away, and disclosure-to-exploit timeframes now run in hours, not months. The Zero Day Clock averages around 8 hours for 2026, down from roughly 53 days just two years ago.
The reflex is usually to patch faster, but remediation isn't simply a switch you flip. Patches wait on regression testing, change windows, and uptime commitments. According to Verizon's 2026 Data Breach Investigations Report, the median fix time for known-exploited vulnerabilities is now 43 days, up from 32 last year. The share of organizations fully patching them is down from 38% to 26%.
The Limitations of Patching and Pentesting
Even the best performers close only 30 to 40% of these vulnerabilities in the first week, a rate that's barely budged in years. When offense runs in hours and remediation runs in weeks, the breach lands in between. Automated pentesting tools can run continuously, but they can't reach what matters. Live exploitation only works where firing an exploit is safe and where a working exploit exists.
There are three gaps that no pentest tool can close: no exploit, nothing to fire; assets you can't risk; and the day-one window. In a typical enterprise, the slice you can safely exploit live is usually only 10 to 15% of your total exposure picture. For the other 85 to 90%, execution has no answer to give.
TTP-Chain Validation
TTP-chain validation involves mapping a CVE to the chain of techniques its exploitation requires, then validating each technique against your existing controls. If your environment breaks any required link, the exploit can't succeed there, and you know it without having to fire a live exploit.
This approach validates by inference, not detonation, making it work where live exploitation would be unsafe or impossible. It's control-aware, reflecting your real EDR, GPO, LSASS protection, allow-listing, and firewall. It weighs reachability, so contained exposures don't get over-counted. It ships evidence, providing an audit trail that survives to the board.
Real-World Example: CVE-2025-29824
Take CVE-2025-29824, a Windows CLFS use-after-free that escalates to SYSTEM. Instead of firing an exploit, you decompose it into the chain an attacker must run and test each step against your stack. If your allow-listing stops the MSBuild exec, or your LSASS protection blocks the credential dump, the chain breaks, the CVE isn't exploitable on that asset, and you can show exactly why.
No certified exploit needed, and it works on the air-gapped box you'd never point a live exploit at. This approach goes from a fresh CVE ID to a defensible decision in hours, on the day of disclosure, rather than weeks later.
Proving Exploitability Everywhere
The launch and the ground test aren't rivals, they're symbiotic. The strongest programs run both, and keep re-testing as the environment moves through time and configurations. This is the loop Picus runs: live exploit chains where firing is safe, TTP-chaining for the off-limits assets and day-one CVEs that a launch can't reach, and continuous control validation.
Put it to the test on the case stuck in your backlog: the CVE on the air-gapped box you can't touch, or the one that dropped this morning with no public exploit yet. Book a demo, and Picus will map it to its TTP chain and show you, against your own controls, whether it's exploitable or not, and why, with the evidence to take to your board.
Source: BleepingComputer