Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Nucleus Insights flagged 14 vulnerabilities with real-world exploitation activity that looked risky before CISA added them to KEV. The key takeaway: all 14 were later listed in KEV. Acting on those signals would have been the right call every time, just earlier.

Let me be direct about something the industry keeps dancing around: the vulnerability problem isn’t getting better. It’s getting structurally worse. The wave of AI-generated code and compression of time to exploit thanks to frontier AI models like Mythos is about to make “worse” look quaint. If your vulnerability and exposure management program is still built around scanner cycles, ticket queues, and CVSS scores, you’re not running a security program.

Security teams didn’t need a headline to tell them that vulnerability volumes continue to be problematic. The CVE database now contains over 354,000 records. Annual disclosure rates have climbed steadily for more than a decade. And remediation backlogs have long been recognized not as an aberration, but as a fixture of the job.

Security teams can’t remediate every vulnerability the moment it appears, so prioritization must separate urgent, business-critical risks from noise. This is complicated by the fact that traditional scoring methods like CVSS often lack the context needed to decide what should be fixed first. The Stakeholder-Specific Vulnerability Categorization (SSVC) framework is one option many organizations use to fill this gap as part of automating vulnerability prioritization.

If you've been following the cybersecurity conversation over the last several weeks, you've heard some version of the phrase “Claude Mythos changes everything.” It’s dominated the industry news cycles since early April. While the capabilities these stories tout are very much real, I have an issue with the framing being wrong when it comes to vulnerability management. There’s a narrative that Mythos and other frontier models will find too many vulnerabilities to deal with.

In the span of six weeks this summer, the United States government issued three separate security directives that, on the surface, appear to address completely different problems. One tightens how federal agencies patch software vulnerabilities. Another creates a government-industry clearinghouse to triage AI-discovered bugs. The third restructures how defense contractors source the raw materials that go into missiles, aircraft, and military electronics. Different agencies. Different languages.

When Anthropic revealed Claude Mythos and Project Glasswing, the industry did what the industry always does with a frontier-AI story: it reached for the alarm. The headlines, Reddit threads, and back-channel conversations all focused on the same things: All of that is real, and none of it is the part that should keep a security leader up at night. Here is the part that should.