What Happened
In the past 18 months, security teams have noticed a shift in how attackers probe their systems. SQL injection vulnerabilities that sat dormant in quarterly scan reports for years are now being exploited within hours of discovery. Authentication bypasses that once required manual testing and deep application knowledge are now being weaponized by scripts that iterate through thousands of permutations automatically.
This isn't a new breach. It's the amplification of every unpatched finding in your backlog.
Timeline: The Amplification Cycle
2019-2022: Your team identified a medium-severity authentication flaw in a legacy API endpoint. It required specific request sequencing and timing to exploit. Manual testing took an experienced pentester 2-3 hours to reproduce. Risk was accepted and deprioritized behind higher-severity findings.
Early 2023: Large language models became accessible. Attackers began using them to generate exploit variations at scale.
Mid 2023-Present: That same authentication flaw is now being probed by automated tools that can generate and test thousands of request sequences per minute. What took a human 2-3 hours now takes an AI-assisted script under 10 minutes. The vulnerability you deprioritized is now being actively exploited.
Which Controls Failed
Vulnerability Prioritization: Your team used CVSS scoring and manual exploitability assessment. The authentication flaw scored 5.3 (Medium) because exploitation required "high attack complexity" and "specialized knowledge." That assessment assumed human attackers with human constraints.
Remediation SLAs: Your policy required critical vulnerabilities patched within 15 days, high within 30 days, medium within 90 days. The authentication flaw fell into the 90-day bucket. It's been 1,400 days.
Attack Surface Monitoring: Your team tracked new vulnerabilities through CVE feeds and vendor advisories. You didn't monitor for changes in exploitability of existing findings.
Security Testing Cadence: Annual penetration tests and quarterly automated scans. No mechanism to reassess whether previously-accepted risks remained acceptable as the threat landscape evolved.
What Standards Require
PCI DSS v4.0.1 Requirement 6.3.2 mandates that you maintain an inventory of bespoke and custom software, and Requirement 11.3.1 requires internal vulnerability scans at least quarterly. But neither addresses how to reassess exploitability when attacker capabilities change.
ISO/IEC 27001:2022 Control 8.8 (Management of technical vulnerabilities) requires you to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures. The standard assumes you'll reassess when new information becomes available. AI-enhanced exploitation is new information.
NIST CSF v2.0 Function: Identify (ID.RA) calls for understanding cybersecurity risk to organizational operations and assets. If your risk assessment doesn't account for automation amplifying exploitation speed and scale, you're not meeting this function.
OWASP ASVS v4.0.3 Section 1.14 (Configuration) states that applications should have a documented security architecture. That architecture should account for threat modeling. If your threat model still assumes human-paced reconnaissance and exploitation, it's outdated.
What Your Team Should Do Now
Reassess your entire vulnerability backlog. Pull every finding from the past 36 months rated Medium or above. For each one, ask: "If an attacker could attempt 10,000 exploit variations per hour instead of 10, does this change the risk rating?" You're looking specifically for vulnerabilities where complexity was the primary barrier to exploitation.
Rewrite your exploitability criteria. CVSS Attack Complexity assumes human attackers. Add a supplemental scoring dimension: "Can this be automated?" If yes, bump the severity. Your authentication bypass isn't Medium anymore.
Implement continuous validation. Don't wait 90 days to scan again. For any vulnerability that could be amplified by automation, validate remediation within 24 hours and rescan weekly until patched. Tools like Nuclei or custom scripts can monitor specific endpoints for regression.
Update your SLAs. If you're still using time-based remediation windows (15/30/90 days), add an acceleration clause: "Vulnerabilities with demonstrated automated exploitation in the wild move to the Critical track regardless of initial CVSS score."
Monitor exploit marketplaces and GitHub. When proof-of-concept code appears for a vulnerability class you have in your backlog, that's your trigger to reprioritize. Set up alerts for your specific technology stack.
Test with AI-assisted tools. Run your own reconnaissance using LLM-powered scanners. See what they find in 10 minutes that your annual pentest found in 10 hours. That gap is what attackers are exploiting.
Document the decision. If you're still accepting risk on a vulnerability that could be AI-amplified, write down why. "Limited budget" is different from "We've confirmed this endpoint isn't internet-accessible and requires VPN + 2FA." One is defensible, one isn't.
AI isn't creating new vulnerability classes. It's removing the friction that made some vulnerabilities "too hard to exploit at scale." Your 2019 scan report just became your 2024 incident response plan. Read it again.
