The Exploit Doesn't Exist. You Can Still Prove It Works Against You

The article warns that AI has compressed the disclosure-to-exploit timeline from months to hours, increasing the risk from unpatched CVEs and reducing the effectiveness of traditional patch-centric programs; it promotes Picus Security’s approach of mapping CVEs into TTP chains and validating each technique against an organization’s actual controls (inference-based, control-aware testing) as a safer way to determine whether exposures are truly exploitable — citing CVE-2025-29824 and RansomEXX-linked activity as an example.