DIGITAL LIFE

Exploitation of cybersecurity vulnerabilities is accelerating. AI and automation may be the only remedy
The number of vulnerabilities mitigated in systems has grown more than 6.5 times in the last four years, but it is not enough. A study by Qualys shows that manual remediation is unable to protect organizations.
With the cybersecurity landscape becoming increasingly complex, security teams are unable to respond to the growing number of vulnerabilities and the need for rapid remediation. The Qualys report, The Broken Physics of Remediation, indicates that the only solution involves the use of Artificial Intelligence and automation.
According to leaked data from the study, the average time to exploit a vulnerability (Time-to-Exploit) has fallen to less than 1 day, indicating that attackers compromise systems even before vulnerabilities are publicly disclosed. The analysis is based on data from more than 10,000 organizations and one billion records collected over four years.
The number of vulnerabilities is also increasing, and the report reveals that resolved vulnerability events increased 6.5 times during this period, from 73 million in 2022 to 473 million in 2025. Even so, security teams left 63% of critical vulnerabilities unresolved on day seven in 2025, a worsening indicator compared to the 56% recorded in 2022.
We are facing a scenario where, for the first time, the adversary has acquired autonomous capabilities and is now able to discover and execute exploits at a speed exceeding the response capacity.
Sergio Pedroche, Country Manager of Qualys Iberia, argues that "in this new context, defense must evolve towards an equally autonomous model, with automation and AI as allies to respond to this new reality."
The report also explores risk assessment for organizations, highlighting that MTTR (mean time to remediation, measured from day 0) does not adequately reflect the real risk to organizations. Therefore, Qualys analysts used the concept of Average Window of Exposure (AWE), which measures the time elapsed between exploitation and remediation.
According to this indicator, 85% of vulnerable assets remained unpatched at the time of disclosure, 33% remained unresolved after 21 days, and 12% after 90 days.
Physical limits of cybersecurity operations...Qualys experts also reveal that zero-day vulnerabilities dominate among critical threats. Of the 52 critical vulnerabilities analyzed, half were exploited before their public disclosure, with extreme cases such as a Windows kernel vulnerability exploited 182 days before becoming public.
Still, less than 1% of vulnerabilities represent a real risk. The report indicates that, of the 48,172 vulnerabilities disclosed in 2025, only 357 (0.74%) were remotely exploitable and were being actively used by attackers.
For the company, this data reinforces the need to adopt prioritization models to identify real threats and automate remediation.
“The instinct to treat each new critical CVE as an isolated emergency – mobilizing the team, prioritizing the call, and rushing to fix it – is understandable. But it’s also unsustainable,” the report states. It further indicates that when the volume of vulnerabilities grows 6.5 times, exploitation timelines become negative, and the lengthy manual remediation process absorbs two-thirds of the cumulative risk, but the reactive model doesn't scale. It's a human limitation that organizations need to consider.
For the study's authors, the way forward is not to respond more quickly to individual vulnerabilities, “it's to build a repeatable operational process – from intelligence ingestion to confirmation and automated action – executed consistently, at scale, without requiring human intervention at each step.”
The organizations analyzed that are already bridging the physical security gap are not winning because they have larger security teams. They are winning because they have operationalized the end-to-end remediation lifecycle in a way that eliminates human latency from the critical path.
According to the security solutions company, the dynamics of the vulnerability farm will continue to accelerate, and the time to operation will not return to positive numbers. The volume of vulnerabilities is also not expected to stabilize.
“The only variable still under the defender’s control is the speed and consistency of the remediation response. And the data in this report demonstrate that the only way to compress that response to the timeframe that the current threat environment demands is to fully operationalize it.”
mundophone





