Time Table

In 2026, the number of published CVEs continues to grow at a pace far exceeding the previous year and is approaching 100,000 annually. At the same time, the number of vulnerabilities discovered with the assistance of AI is also rising rapidly, increasing the importance of risk-based vulnerability management. However, for some N-day vulnerabilities, simply waiting for them to be added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog may leave defenders reacting too late.

In this talk, we first analyze trends in CVE disclosures, KEV additions, and related data to examine how vulnerability exploitation is evolving in the AI era and discuss what those trends mean for vulnerability management. We then present the results of an experiment in which AI was tasked with handling the ANTERAS ASM workflow from asset discovery through risk assessment. By comparing an asset discovery phase performed with clearly defined procedures against a risk assessment phase in which the AI was given no explicit procedure and was limited to non-intrusive interactions, we examine what AI-driven ASM can realistically do today—and where its limits remain.

Speakers:
Takeya Yamazaki Senior Specialist, Security Research Center
Yudai Yahara Networks Company, Macnica, Inc.