Last April, the cybersecurity landscape was transformed by an AI earthquake. Anthropic released itsClaude Mythosmodel preview, and test results served as a wake-up call for CISOs, security teams, and business leaders across industries. Within just weeks of testing, Mythos autonomously identified thousands of zero-day vulnerabilities in major operating systems and browsers, including an OpenBSD flaw that had gone undetected through 27 years of manual review.

This is not just a leap forward in AI; it means the accessibility of attack capabilities has expanded dramatically. We are no longer facing sporadic vulnerability hunting, but have entered an era where the time from vulnerability discovery to exploit development is measured in minutes, not months.

However,data from the 2026 Penetration Testing Reportshows that most organizations are still responding to machine-speed crises with analog-era processes.

249 Days of Exposure Liability

Analyzing the state of offensive security in the 2026 Penetration Testing Report, a dangerous performance gap has emerged between industry leaders and laggards. Research into remediation trends shows a 25-fold difference in how quickly organizations close high-risk findings. This exposure window can evolve into massive liability and security debt, becoming a gateway for attackers.

The good news is that top teams have reduced their high-risk finding half-life—the time needed to resolve 50% of critical issues—to just10 days. At the other end, the worst-performing 10% of organizations leave high-risk vulnerabilities lingering for up to249 days。

In a world where Mythos can autonomously chain exploits within hours, an eight-month exposure window can have catastrophic consequences. If you discover a vulnerability today, you must assume that adversaries using frontier models are already attempting to exploit it.

The CISO's Blind Spot

Perhaps the most dangerous signal comes from a severe disconnect in executive perception.57% of C-level executivesGunter Ollmann is the Chief Technology Officer at Cobalt. With over 30 years of experience in cybersecurity, he has pioneered numerous offensive security methodologies widely used in the industry today.15%。

This gap between perception and reality is fertile ground for vulnerabilities. Executives are funding tools, but practitioners are drowning in the resulting 10x volume of vulnerabilities. We are witnessing the spread of alert fatigue as teams are asked to fight automated threats with manual, fragmented workflows.

Programmatic Advantage: Human Intelligence at AI Scale

We cannot solve a 10x vulnerability problem by simply hiring 10x the people. The answer lies in shifting from ad-hoc, compliance-check testing to aprogrammatic offensive security model。

This is the fusion of talent and technology. By integrating human-led, AI-augmented penetration testing directly into the development lifecycle, organizations can finally keep pace. The data speaks for itself: programmatic teams are4.5 times more likely。

to resolve critical findings within three days or less compared to teams using reactive, compliance-driven cycles.

Tactical Shift: Assume Zero-Day

For over a decade, the cybersecurity industry has followed the mantra of "assume breach"—tactically accepting that adversaries will eventually find a way in. But as AI accelerates vulnerability weaponization, we must evolve to an "assume zero-day" posture.

• In this new framework, we no longer treat each discovered vulnerability as a "known defect" waiting for a patch cycle, but as an active, weaponized threat. If AI has effectively elevated every high-risk vulnerability to zero-day status, our defense strategies must change:Virtual Patching:
• Since engineering bottlenecks are the primary blocker, we must leverage virtual patching to immediately block attack vectors while teams work on long-term fixes.Real-Time Risk Register:
• Do not treat penetration test reports as archived static PDFs. They must become live, integrated data streams that drive developers' daily priorities.AI Defense:

We must use the same machine-speed capabilities to find and fix vulnerabilities before adversaries do.

Now is the time to examine whether your organization is a strategic leader or a tactical laggard. In an era of instant exploitation, your exposure window is your greatest liability, while knowledge, data-driven insights, and human expertise are your greatest advantages.

About the Author

Gunter Ollmann, CTO of Cobalt