AI-Enabled Adversaries Compress Time-to-Exploit Following Vulnerability Disclosure

Rapid7's 2026 Global Threat Landscape Report warns that AI and automation compressed the window between vulnerability disclosure and exploitation in 2025, with median time to CISA KEV inclusion dropping from 8.5 to 5 days and confirmed exploitation of CVSS 7–10 vulnerabilities rising 105% YoY. The report highlights commonly exploited flaw types (deserialization, authentication bypass, memory corruption), notes that vulnerability exploitation accounted for 25% of initial access while valid accounts/no MFA were the single largest vector (44%), and urges organizations to adopt pre-emptive attack-surface reduction and context-aware prioritization.