The Exposure Gap: From Vulnerability Management to AI-Driven Attack Surface Control

Introduction

What used to be castle walls and thoroughly inspecting traffic in and out has expanded to multicloud, hybrid environments, operational technology mixed with IT, off-prem identity systems, and third-party ecosystems that change daily. Traditional vulnerability management was not designed for this diversity and scale.

When this is combined with the two facts of cybersecurity—vulnerabilities increase steadily over time, and attackers are weaponizing and exploiting vulnerabilities faster than ever—it no longer takes expert talent to be an attacker, just an AI model and ideas of mischief.

To put the problem into perspective: More than 48,000 common vulnerabilities and exposures (CVEs) were published in 2025 (see Figure 1). Most organizations realistically can’t remediate them all. The Exploit Prediction Scoring System (EPSS) provides organizations more insights into vulnerabilities that could be exploited, but it is not enough and it covers only parts of the overall complexity.

In addition, vulnerabilities are not the only vector: Supply chains are being poisoned, attacking organizations from the inside out with new and novel attacks against package managers and code dependencies.

Cybersecurity evolves quickly. Developers and the “go-to-market” situation force organizations to move quickly. At the same time, the number of vulnerabilities and how attackers are using them is changing quickly. That’s why it’s important for defenders to also move quickly, and pitching AI against AI is, at this point, one of the better ways to start fighting back.