Attack automation runs on economics - and that is your advantage
AI agents now scan code, find vulnerabilities, and generate working exploits end-to-end. The obvious conclusion - "machines will exploit everything, so ranking anything is pointless" - is exactly wrong. Here is what the data says, and what to do about it.
Time-to-exploit is the gap between a CVE's public disclosure and the first dated evidence of confirmed exploitation in the wild. Measured across our own evidence base, over the CVEs confirmed exploited within 90 days after disclosure, or at any point in the six months before it, over the last five years:
| By the time this happens | Exploitation already under way |
|---|---|
| before the advisory is published | 37.7% |
| the advisory is 24 hours old | 60.7% |
| a next-day patch ships | 64.5% |
| a weekly patch cycle runs | 74.1% |
| a monthly patch cycle runs | 85% |
Each row is cumulative - it counts every CVE already exploited at that point, including the ones exploited before the advisory existed.
60.7% of exploited CVEs are already under attack 24 hours after disclosure, and 37.7% before the advisory was published at all. zerodayclock.com asks the same question against CISA KEV and VulnCheck KEV timelines and reports faster figures still, a median measured in hours for the most recent years. Their sources carry clock times ours do not, so read theirs as the aggressive estimate and these as the conservative one.
One caution about the framing this data usually gets. A per-year median time-to-exploit is right-censored: an older cohort has had years to accumulate its slowly exploited CVEs while the current one has had months, so a median that appears to collapse year over year is partly measuring how long each cohort has been watched rather than how fast attackers move. Hold the observation window constant and our own median sits between two and four days in every year since 2018. The immediacy in the table is the durable finding. The collapse is mostly an artifact.
And yet the same evidence base carries a second, less quoted number: of the 48,178 CVEs published in 2025, 487 carry confirmed exploitation in the wild - 1% of the year's disclosures. Automation compressed the when. It did not expand the which.
An AI attack campaign is a business with a cost sheet. Tokens cost money. Compute costs money. Infrastructure, laundering, and operational risk cost money. The campaign is judged on cost per compromise, and that number dictates behavior - the same way it always has, just faster:
| Attack path | Marginal cost | Behavior it produces |
|---|---|---|
| Run an existing weaponized exploit at scale | ≈ zero | Mass scanning, mass exploitation. This is where the volume lives - and always will, because the price is right. |
| AI-adapt a public PoC, or patch-diff an advisory | Cheap | The advisory and the exploit recipe are the same document; a model reads it in seconds. This path is why so much exploitation lands on or before disclosure day. |
| AI de-novo vulnerability discovery against a hardened target | Expensive - real token burn per target | Reserved for targets whose value justifies the spend. Not a mass phenomenon; an APT phenomenon. |
The least-resistance path did not disappear when attackers got AI. It became more dominant, because automation punishes waste even harder than human operations did. Burning thousands of tokens hunting a novel bug in your infrastructure only makes sense if you are the target worth it. For everyone else - which is nearly everyone - the campaign runs down the cheap list: weaponized, automatable, exposed.
Notice what that list is. Attackers are running a risk model in reverse: exposure × automatability × exploit availability. Their target function is exactly the evidence an exploitation feed tracks. What is cheap for them is what is urgent for you. Attack economics is not the obstacle to prioritization - it is the reason prioritization works.
Suppose AI fixes code for you. Suppose your remediation agents open perfect pull requests on demand. Two costs remain, and neither shrinks with model quality:
- Applying the fix. Change windows, regression testing, reboot cycles, service coordination, rollback plans. Fix supply got cheap; fix application did not. Your estate still absorbs a finite number of changes per week - the bottleneck simply moved to the question: which change goes through the next window first?
- Feeding the agents. Every finding you hand an AI remediation fleet burns tokens - triage tokens, analysis tokens, patch-generation tokens, test tokens. Multiply by a CVSS-sorted queue where half of everything is "critical" and you are paying real money to fix findings nobody attacks, while the CVE weaponized last night waits at position #847.
This is the symmetry that decides the AI era: attack automation and defense automation are both resource-allocation machines. The one that wins is the one pointed at the right targets. Pointing is the whole game now.
1 · Rank by decision, not by score
The decision framework merges locked feed facts (exploitation maturity, automatability) with your context (exposure, mission consequence) and outputs an action: Immediate, Out of cycle, Scheduled, Defer. Two knobs. Your patch queue reorders itself as the feed moves:
# nightly: what changed, then one bulk decision call under your context
curl -s -H "Authorization: Bearer $HARPIA_KEY" \
"https://harpia.ae/api/v1/vulnerabilities/changes?since=$LAST_RUN" > delta.json
jq '{ids:[.[].id], exposure:"controlled", mission_consequence:"high"}' delta.json \
| curl -s -H "Authorization: Bearer $HARPIA_KEY" -H "Content-Type: application/json" \
-d @- "https://harpia.ae/api/v1/decisions/evaluate" \
| jq '[.[] | select(.decision=="immediate" or .decision=="out_of_cycle")]'Two requests a night re-rank an entire estate - regardless of its size.
2 · Give your AI agents a budget gate
If you run automated remediation, make the decision the admission ticket: agents work
immediate and out_of_cycle findings only. Token spend concentrates
where attacker spend concentrates. Everything else waits for the scheduled cycle, where
batch economics are on your side.
3 · Let the watch-lists maintain themselves
Subscribe your SIEM or TIP to the TAXII feed -
exploited-in-wild for the active set. When a CVE crosses the line, your detection surface already knows; no
analyst re-curates a spreadsheet.
4 · Watch momentum, not just state
With 60.7% of exploited CVEs already under attack 24 hours
after disclosure, waiting for "exploited" is often already late for
internet-facing assets. The trending and momentum signals surface
CVEs accelerating toward exploitation - for your open+critical assets, that is the
window in which acting early is cheap.
The AI era did not repeal attack economics - it enforced them at machine speed. Attackers still follow the cheap path; the cheap path is still observable; and defenders who allocate against that observation still beat defenders who allocate against a static score. The difference is that the penalty for slow, wrong prioritization used to be measured in months. Now it is measured in hours - some of them negative.