VulnCheck's State of Exploitation Report with Patrick Garrity

The podcast discusses findings from the Volchek State of Exploitation 1H 2026 report, focusing on trends in vulnerability exploitation and the evolving role of AI in cybersecurity. The report analyzes over 5,000 known exploited vulnerabilities (KEVs), a significantly broader dataset than CISA's KEV list, incorporating data from public disclosures, honeypots, and real-world canary systems. It highlights that while the total number of CVEs is rising sharply, only a small fraction are actively exploited, with exploitation rates increasing modestly by 5 - 10%. Despite claims about accelerating exploit speeds, the median time to exploit remains around 80 days, though pre-disclosure exploits still occur in over 20% of cases. Defenders are urged to focus on patching high-risk technologies like CMS platforms and using mitigations such as Web Application Firewalls.

A key theme is skepticism toward the narrative that AI is dramatically accelerating vulnerability discovery and exploitation. While AI tools are increasingly identifying flaws, the greater risk lies in the vulnerabilities present within AI products themselves - such as LangFlow, Gradio, and N8N - which are often deployed without sufficient hardening. These tools pose serious risks due to their integration with core systems, enabling credential harvesting and crypto mining. Additionally, concerns are raised about transparency and coordination in AI-driven vulnerability reporting, with examples like Anthropic's under-maintained vulnerability ledger showing major gaps between claimed discoveries and actual disclosures. The discussion underscores the need for better coordination, concise reporting, and human-led processes to manage the influx of AI-generated findings, warning against hype and emphasizing data-driven, practical approaches to security.

• What if you built a real-time AI product vulnerability scanner for your SaaS apps?

  • Move: Identify the top 5 AI-powered tools (e.g., LangFlow, Gradio, Flowise) used in developer workflows and create a lightweight script that checks running instances against Volchek's KEV database via API. Automate weekly scans across your infrastructure.
  • Why Now?: Exploits targeting AI products are rising, with many tools being deployed unhardened; early detection gives solo operators an edge before breaches occur.
  • Expected Upside: Reduce exposure to credential harvesting or crypto mining attacks by proactively securing AI tooling - potentially avoiding costly incidents and gaining trust as a security-conscious dev.

• What if you prioritized patching based on actual exploitation data instead of CVE volume?

  • Move: Subscribe to Volchek's expanded KEV list (5,000+ exploited vulnerabilities), filter it down to technologies you use (e.g., WordPress, Oracle WebLogic), and build a monthly patching checklist focused only on exploited-in-the-wild flaws.
  • Why Now?: Only ~2% of vulnerabilities are actively exploited, but noise from millions of CVEs distracts developers; using real-world exploitation data cuts through the clutter.
  • Expected Upside: Achieve higher security ROI by focusing effort where risk is proven - reducing attack surface faster than peers relying on generic CVSS scores.

• What if you created a micro-SaaS that validates AI-generated vulnerability reports for open-source maintainers?

  • Move: Build a simple web app that takes AI-written reports, strips fluff, extracts technical details (CWE, PoC code, affected versions), and outputs concise, actionable tickets ready for triage - integrate with GitHub Issues and send alerts.
  • Why Now?: Open-source projects are overwhelmed by verbose, redundant AI reports; providing signal over noise positions you as a utility in a growing coordination bottleneck.
  • Expected Upside: Capture niche market among maintainers drowning in reports - monetize via sponsorships or freemium model while establishing authority in secure AI integration.

• Monitor and prioritize vulnerabilities in widely used technologies like WordPress, Joomla, and Oracle WebLogic by subscribing to reliable threat intelligence sources and setting up automated alerts for new KEVs (Known Exploited Vulnerabilities) beyond just CISA's list.
• Implement a strict patching schedule for high-risk, internet-facing systems - especially CMS platforms - and complement it with a Web Application Firewall (WAF) to mitigate exploitation risk while patches are deployed.
• Treat AI-powered tools (e.g., LangFlow, Gradio, Flowwise) as high-risk attack surface components; audit their usage, restrict network access, and harden configurations before deployment in production environments.
• Focus vulnerability monitoring on actionable, verified disclosures by filtering out low-evidence or redundant AI-generated reports; cross-reference findings with multiple sources like honeypot data and VulnShare Canaries to confirm real-world exploitation.
• Contribute fixes - not just vulnerability reports - to open-source projects you depend on, especially when maintainers are overwhelmed, to improve security outcomes and reduce notification fatigue across the ecosystem.